598
Example 2:
The _alloca() function allocates memory on the stack. If an allocation request is too large for the
available stack space, _alloca() throws an exception. If the exception is not caught, the program will
crash, potentially enabling a denial of service attack. _alloca() has been deprecated as of Microsoft
Visual Studio 2005(R). It has been replaced with the more secure _alloca_s().
Example 3:
EnterCriticalSection() can raise an exception, potentially causing the program to crash. Under
operating systems prior to Windows 2000, the EnterCriticalSection() function can raise an
exception in low memory situations. If the exception is not caught, the program will crash,
potentially enabling a denial of service attack.
Observed Examples
Reference Description
CVE-2023-41151 SDK for OPC Unified Architecture (OPC UA) server has uncaught exception
when a socket is blocked for writing but the server tries to send an error
https://www.cve.org/CVERecord?id=CVE-2023-41151
CVE-2023-21087 Java code in a smartphone OS can encounter a "boot loop" due to an
uncaught exception
https://www.cve.org/CVERecord?id=CVE-2023-21087
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 227 7PK - API Abuse 700 2313
MemberOf 730 OWASP Top Ten 2004 Category A9 - Denial of Service 711 2339
MemberOf 851 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 8 - Exceptional Behavior (ERR)
844 2365
MemberOf 884 CWE Cross-section 884 2567
MemberOf 962 SFP Secondary Cluster: Unchecked Status Condition 888 2400
MemberOf 1141 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 07. Exceptional Behavior (ERR)
1133 2448
MemberOf 1181 SEI CERT Perl Coding Standard - Guidelines 03.
Expressions (EXP)
1178 2466
MemberOf 1410 Comprehensive Categorization: Insufficient Control
Flow Management
1400 2536
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
7 Pernicious Kingdoms Often Misused: Exception Handling
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR05-J Do not let checked exceptions escape
from a finally block
The CERT Oracle Secure
Coding Standard for Java
(2011)
ERR06-J Do not throw undeclared checked
exceptions
SEI CERT Perl Coding
Standard
EXP31-
PL
Exact Do not suppress or ignore exceptions
Software Fault Patterns SFP4 Unchecked Status Condition
References
CWE Version 4.14
CWE-250: Execution with Unnecessary Privileges
CWE-250: Execution with Unnecessary Privileges