1131
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1228 API / Function Errors 2482
Weakness Ordinalities
Indirect :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Other Quality Degradation
Varies by Context
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 398 7PK - Code Quality 700 2323
MemberOf 998 SFP Secondary Cluster: Glitch in Computation 888 2419
MemberOf 1412 Comprehensive Categorization: Poor Coding Practices 1400 2538
Notes
Other
The Linux Standard Base Specification 2.0.1 for libc places constraints on the arguments to
some internal functions [21]. If the constraints are not met, the behavior of the functions is not
defined. It is unusual for this function to be called directly. It is almost always invoked through a
macro defined in a system header file, and the macro ensures that the following constraints are
met: The value 1 must be passed to the third parameter (the version number) of the following
file system function: __xmknod The value 2 must be passed to the third parameter (the group
argument) of the following wide character string functions: __wcstod_internal __wcstof_internal
__wcstol_internal __wcstold_internal __wcstoul_internal The value 3 must be passed as the first
parameter (the version number) of the following file system functions: __xstat __lxstat __fxstat
__xstat64 __lxstat64 __fxstat64
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Undefined Behavior
Software Fault Patterns SFP1 Glitch in computation
References
CWE Version 4.14
CWE-476: NULL Pointer Dereference
CWE-476: NULL Pointer Dereference