VNX-403: Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')

A long-lived descriptor is opened without close-on-exec (open/openat/creat without O_CLOEXEC, socket without SOCK_CLOEXEC, fopen without "e") and not closed nearby, in a C/C++ file that starts other programs (exec*, posix_spawn, popen, system), so every child inherits it.

Field	Value
Rule ID	`VNX-403`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-403
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`fd-leak` `cwe-403`
Source	`internal/sast/rules/vnx-403.rego`

Overview

VNX-403 maps to CWE-403: Exposure of File Descriptor to Unintended Control Sphere (‘File Descriptor Leak’). A long-lived descriptor is opened without close-on-exec (open/openat/creat without O_CLOEXEC, socket without SOCK_CLOEXEC, fopen without “e”) and not closed nearby, in a C/C++ file that starts other programs (exec*, posix_spawn, popen, system), so every child inherits it.

Why This Matters

This weakness class (Exposure of File Descriptor to Unintended Control Sphere (‘File Descriptor Leak’)) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-403 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

log_fd = open(path, O_WRONLY | O_APPEND | O_CREAT, 0600);   /* FLAGGED */
a->ctrl_sock = socket(AF_UNIX, SOCK_STREAM, 0);             /* FLAGGED */
audit = fopen(path, "a");                                   /* FLAGGED */
...
execvp(argv[0], argv);       /* or popen(), system(), posix_spawnp() in the same file */

Not flagged: O_CLOEXEC, SOCK_CLOEXEC, fopen(path, "ae"), fcntl(fd, F_SETFD, FD_CLOEXEC) anywhere in the file, a close-every-descriptor loop or close_range()/closefrom() before exec, a descriptor closed (or dup2ed) within 40 lines of opening it, and files that never start another program. An exec in a different file from the open is not followed.

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-403 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-403 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-403
// nosec vnx-403

Or record an ignore rule: vulnetix ignore add --rule vnx-403 --reason "...". See Suppressing findings.