VNX-1082: Class Instance Self Destruction Control Element

Field	Value
Rule ID	VNX-1082
Severity	Low
SARIF level	note
Kind	sast
Languages	C++
CWE	CWE-1082
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	self-destruction delete-this object-lifetime cwe-1082
Source	internal/sast/rules/vnx-1082.rego

Overview

VNX-1082 maps to CWE-1082: Class Instance Self Destruction Control Element. A C++ member function that destroys the object it runs on: delete this; or an explicit call of its own destructor.

Why This Matters

After delete this or this->~T(), any use of the object, by the rest of the method or by a caller still holding a pointer or reference to it, is a use after free. delete this on an object that was not allocated with plain new (on the stack, as a member, in an array, or by placement new) is undefined behaviour.

What Gets Flagged

void Connection::close() {
    ::close(socket_);
    delete this;                         // FLAGGED
}

void Session::reset() {
    this->~Session();                    // FLAGGED
    new (this) Session();
}

void Release() {
    if (--refs_ == 0) delete this;       // FLAGGED: intrusive refcount, same construct
}

Also reported: delete (this);, delete static_cast<Derived*>(this); and std::destroy_at(this);.

Intrusive reference counting is reported because it is the same construct; review that such objects are always heap-allocated and never touched after the final release.

What Does Not Get Flagged

• Deleting another object or a member: delete this->header_;, delete other;, delete[] data_;.
• Destroying a different object explicitly, as an object pool does: item->~Item();.
• Destructor definitions (Buffer::~Buffer()).
• The text inside comments and string literals.
• Java, Python and other managed languages, which have no self-destruction construct.

Remediation

1. Give ownership to the caller or a container: return the object to its owner, or hold it in std::unique_ptr/std::shared_ptr and let the owner release it.
2. If self-deletion is unavoidable (reference counting), make the destructor private or protected so the object can only be created with new, and return immediately after delete this.
3. For a confirmed false positive, add // vulnetix-ignore: VNX-1082 on the line.

References

• CWE-1082: Class Instance Self Destruction Control Element

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1082
// nosec vnx-1082

Or record an ignore rule: vulnetix ignore add --rule vnx-1082 --reason "...". See Suppressing findings.