606
[REF-199]NIST. "United States Government Configuration Baseline (USGCB)". < https://
csrc.nist.gov/Projects/United-States-Government-Configuration-Baseline >.2023-03-28.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-252: Unchecked Return Value
Weakness ID : 252
Structure : Simple
Abstraction : Base
Description
The product does not check the return value from a method or function, which can prevent it from
detecting unexpected states and conditions.
Extended Description
Two common programmer assumptions are "this function call can never fail" and "it doesn't matter
if this function call fails". If an attacker can force the function to fail or otherwise return a value
that is not expected, then the subsequent program logic could lead to a vulnerability, because the
product is not in a state that the programmer assumes. For example, if the program calls a function
to drop privileges but does not check the return code to ensure that privileges were successfully
dropped, then the program will continue to operate with the higher privileges.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 754 Improper Check for Unusual or Exceptional Conditions 1568
ParentOf 690 Unchecked Return Value to NULL Pointer Dereference 1514
PeerOf 273 Improper Check for Dropped Privileges 660
CanPrecede 476 NULL Pointer Dereference 1132
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 754 Improper Check for Unusual or Exceptional Conditions 1568
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 389 Error Conditions, Return Values, Status Codes 2322
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Background Details
CWE Version 4.14
CWE-252: Unchecked Return Value
CWE-252: Unchecked Return Value