614
Nature Type ID Name Page
ChildOf 754 Improper Check for Unusual or Exceptional Conditions 1568
ChildOf 573 Improper Following of Specification by Caller 1298
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 389 Error Conditions, Return Values, Status Codes 2322
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Availability
Integrity
Unexpected State
DoS: Crash, Exit, or Restart
An unexpected return value could place the system in
a state that could lead to a crash or other unintended
behaviors.
Potential Mitigations
Phase: Architecture and Design
Strategy = Language Selection
Use a language or compiler that uses exceptions and requires the catching of those exceptions.
Phase: Implementation
Properly check all functions which return a value.
Phase: Implementation
When designing any function make sure you return a value or throw an exception in case of an
error.
Demonstrative Examples
Example 1:
This code attempts to allocate memory for 4 integers and checks if the allocation succeeds.
Example Language: C (Bad)
tmp = malloc(sizeof(int) * 4);
if (tmp < 0 ) {
perror("Failure");
//should have checked if the call returned 0
}
The code assumes that only a negative return value would indicate an error, but malloc() may
return a null pointer when there is an error. The value of tmp could then be equal to 0, and the error
would be missed.
Observed Examples
Reference Description
CVE-2023-49286 Chain: function in web caching proxy does not correctly check a return value
(CWE-253) leading to a reachable assertion (CWE-617)
https://www.cve.org/CVERecord?id=CVE-2023-49286
CWE Version 4.14
CWE-256: Plaintext Storage of a Password
CWE-256: Plaintext Storage of a Password