611
pthread_mutex_unlock(mutex);
}
However, the code does not check the value returned by pthread_mutex_lock() for errors. If
pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race
condition into the program and result in undefined behavior.
In order to avoid data races, correctly written programs must check the result of thread
synchronization functions and appropriately handle all errors, either by attempting to recover from
them or reporting them to higher levels.
Example Language: C (Good)
int f(pthread_mutex_t *mutex) {
int result;
result = pthread_mutex_lock(mutex);
if (0 != result)
return result;
/* access shared resource */
return pthread_mutex_unlock(mutex);
}
Observed Examples
Reference Description
CVE-2020-17533 Chain: unchecked return value (CWE-252) of some functions for policy
enforcement leads to authorization bypass (CWE-862)
https://www.cve.org/CVERecord?id=CVE-2020-17533
CVE-2020-6078 Chain: The return value of a function returning a pointer is not checked for
success (CWE-252) resulting in the later use of an uninitialized variable
(CWE-456) and a null pointer dereference (CWE-476)
https://www.cve.org/CVERecord?id=CVE-2020-6078
CVE-2019-15900 Chain: sscanf() call is used to check if a username and group exists, but the
return value of sscanf() call is not checked (CWE-252), causing an uninitialized
variable to be checked (CWE-457), returning success to allow authorization
bypass for executing a privileged (CWE-863).
https://www.cve.org/CVERecord?id=CVE-2019-15900
CVE-2007-3798 Unchecked return value leads to resultant integer overflow and code
execution.
https://www.cve.org/CVERecord?id=CVE-2007-3798
CVE-2006-4447 Program does not check return value when invoking functions to drop
privileges, which could leave users with higher privileges than expected by
forcing those functions to fail.
https://www.cve.org/CVERecord?id=CVE-2006-4447
CVE-2006-2916 Program does not check return value when invoking functions to drop
privileges, which could leave users with higher privileges than expected by
forcing those functions to fail.
https://www.cve.org/CVERecord?id=CVE-2006-2916
CVE-2008-5183 chain: unchecked return value can lead to NULL dereference
https://www.cve.org/CVERecord?id=CVE-2008-5183
CVE-2010-0211 chain: unchecked return value (CWE-252) leads to free of invalid, uninitialized
pointer (CWE-824).
https://www.cve.org/CVERecord?id=CVE-2010-0211
CVE-2017-6964 Linux-based device mapper encryption program does not check the return
value of setuid and setgid allowing attackers to execute code with unintended
privileges.
https://www.cve.org/CVERecord?id=CVE-2017-6964
CWE Version 4.14
CWE-252: Unchecked Return Value
CWE-252: Unchecked Return Value