Track file descriptor ownership and close them once they are no longer valid, then clear or invalidate every alias that might reuse them. Check return values from close and open operations, and avoid passing stale descriptors across threads or processes. Stress testing and sanitised builds can expose descriptor reuse bugs.
What can go wrong when a file descriptor outlives the object it was meant to represent?
An expired file descriptor is dangerous because it can still look valid while pointing at a different resource after the original one has been closed and reused. The main failure mode is confused ownership: code keeps operating on a stale handle, assuming it still refers to the intended file, socket, or pipe. That can create integrity bugs, data loss, or unintended access.
In practice, the risk is highest when descriptors are copied into caches, aliases, shared structures, or long-lived objects and then reused after a close. The problem is not just invalid use, but mistaken trust in a handle whose identity may no longer match the original resource.
Which mitigations actually reduce descriptor reuse bugs?
The strongest mitigation is to make descriptor lifetime explicit. Close descriptors as soon as they are no longer needed, then clear every alias so no stale reference survives in another structure, thread, or process. Treat ownership as a design rule, not a cleanup task. A descriptor should have one clear owner, one clear release point, and one clear invalidation path.
It also helps to check the return value from close and open operations, because failure can leave state ambiguous. If a close fails, the code should not assume the descriptor is safe to discard. If an open fails, do not proceed as though a fresh descriptor exists. Defensive handling is important because reuse bugs often begin as error-handling bugs.
Cross-thread and cross-process handoff deserves extra care. Passing descriptors between workers, event loops, or forked processes can make it hard to prove who owns the handle and when it becomes invalid. Use a handoff pattern that preserves single ownership, and avoid sharing raw descriptors unless the design truly requires it.
How do you find these bugs before they become production defects?
Stress testing is useful because descriptor reuse problems often appear only under timing pressure, high churn, or unusual interleavings. Sanitised builds and other runtime instrumentation can expose paths where code reuses a descriptor after close, closes the same descriptor twice, or assumes a handle still maps to the original resource.
Static review should look for lifetime gaps, especially where a descriptor is stored in multiple places, passed through callbacks, or reused after error recovery. The safer the abstraction around descriptor ownership, the easier it is to prove that stale values are never dereferenced as live ones.
Risk and Threat Considerations
Expired file descriptor bugs become security issues when stale handles are used to reach the wrong resource, bypass intended checks, or operate on a newly assigned object that the code never meant to touch. The impact depends on what the descriptor can access, but the underlying failure is always the same: a trust boundary built around lifetime assumptions that the program no longer enforces.
Failure mechanism: A descriptor is closed, reused by the kernel or runtime, and later referenced through an alias that was never invalidated, so the program acts on the wrong resource.
Impact: This can cause corruption, unintended reads or writes, access to the wrong file or stream, and hard-to-debug race conditions that may only surface under load.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-8 — Audit Log Management | Descriptor lifetime bugs are found through testing and runtime visibility. |
| Recommendation — Log descriptor close/open failures and suspicious reuse patterns for investigation. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Operational telemetry helps detect stale-handle misuse and race-driven reuse. |
| Recommendation — Record handle lifecycle events needed to reconstruct descriptor reuse paths. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Checking close/open returns and instrumented testing are central to catching these defects. |
| V15 — Secure Coding and Architecture | The issue is a lifetime-management flaw in code structure and ownership boundaries. | |
| Recommendation — Validate error handling and log unexpected descriptor lifecycle failures. Design explicit ownership and invalidation rules for every descriptor alias. | ||
Practitioner Guidance
What to verify: Confirm that every descriptor has a documented owner and that the code path which closes it also clears all cached references, wrappers, or adjacent state that could be reused later.
What practitioners underestimate: The hardest part is often not the close call itself, but proving that no stale alias survives in another scope, thread, or error path. If that proof is weak, the design is still fragile even when tests pass.
Practitioner takeaway: Treat descriptor lifetime as an ownership problem first and a cleanup problem second, because most reuse bugs come from stale references that outlive the handle, not from the close call alone.
Related resources from NHI Mgmt Group
- Guide: CWE Top 25 Guide
- What mitigations reduce the risk of File Descriptor Leak?
- How should teams reduce the risk from exposed NHI secrets?
- Why does SELinux reduce risk on systems that already use Linux file permissions?
- How should security teams use file reputation checks to reduce supply chain and build pipeline risk?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org