1515
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 252 Unchecked Return Value 606
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Crash, Exit, or Restart
Integrity
Confidentiality
Availability
Execute Unauthorized Code or Commands
Read Memory
Modify Memory
In rare circumstances, when NULL is equivalent to the 0x0
memory address and privileged code can access it, then
writing or reading memory is possible, which may lead to
code execution.
Detection Methods
Black Box
This typically occurs in rarely-triggered error conditions, reducing the chances of detection during
black box testing.
White Box
Code analysis can require knowledge of API behaviors for library functions that might return
NULL, reducing the chances of detection when unknown libraries are used.
Demonstrative Examples
Example 1:
The code below makes a call to the getUserName() function but doesn't check the return value
before dereferencing (which may cause a NullPointerException).
Example Language: Java (Bad)
String username = getUserName();
if (username.equals(ADMIN_USER)) {
...
}
Example 2:
This example takes an IP address from a user, verifies that it is well formed and then looks up the
hostname and copies it into a buffer.
Example Language: C (Bad)
void host_lookup(char *user_supplied_addr){
struct hostent *hp;
in_addr_t *addr;
CWE Version 4.14
CWE-690: Unchecked Return Value to NULL Pointer Dereference
CWE-690: Unchecked Return Value to NULL Pointer Dereference