1136
If a user supplies a malformed request or violates the client policy, the Do method can return a nil
response and a non-nil err.
This HandleRequest Function evaluates the close before checking the error. A deferred call's
arguments are evaluated immediately, so the defer statement panics due to a nil response.
Observed Examples
Reference Description
CVE-2005-3274 race condition causes a table to be corrupted if a timer activates while it is
being modified, leading to resultant NULL dereference; also involves locking.
https://www.cve.org/CVERecord?id=CVE-2005-3274
CVE-2002-1912 large number of packets leads to NULL dereference
https://www.cve.org/CVERecord?id=CVE-2002-1912
CVE-2005-0772 packet with invalid error status value triggers NULL dereference
https://www.cve.org/CVERecord?id=CVE-2005-0772
CVE-2009-4895 Chain: race condition for an argument value, possibly resulting in NULL
dereference
https://www.cve.org/CVERecord?id=CVE-2009-4895
CVE-2020-29652 ssh component for Go allows clients to cause a denial of service (nil pointer
dereference) against SSH servers.
https://www.cve.org/CVERecord?id=CVE-2020-29652
CVE-2009-2692 Chain: Use of an unimplemented network socket operation pointing to an
uninitialized handler function (CWE-456) causes a crash because of a null
pointer dereference (CWE-476).
https://www.cve.org/CVERecord?id=CVE-2009-2692
CVE-2009-3547 Chain: race condition (CWE-362) might allow resource to be released before
operating on it, leading to NULL dereference (CWE-476)
https://www.cve.org/CVERecord?id=CVE-2009-3547
CVE-2009-3620 Chain: some unprivileged ioctls do not verify that a structure has been
initialized before invocation, leading to NULL dereference
https://www.cve.org/CVERecord?id=CVE-2009-3620
CVE-2009-2698 Chain: IP and UDP layers each track the same value with different
mechanisms that can get out of sync, possibly resulting in a NULL dereference
https://www.cve.org/CVERecord?id=CVE-2009-2698
CVE-2009-2692 Chain: uninitialized function pointers can be dereferenced allowing code
execution
https://www.cve.org/CVERecord?id=CVE-2009-2692
CVE-2009-0949 Chain: improper initialization of memory can lead to NULL dereference
https://www.cve.org/CVERecord?id=CVE-2009-0949
CVE-2008-3597 Chain: game server can access player data structures before initialization has
happened leading to NULL dereference
https://www.cve.org/CVERecord?id=CVE-2008-3597
CVE-2020-6078 Chain: The return value of a function returning a pointer is not checked for
success (CWE-252) resulting in the later use of an uninitialized variable
(CWE-456) and a null pointer dereference (CWE-476)
https://www.cve.org/CVERecord?id=CVE-2020-6078
CVE-2008-0062 Chain: a message having an unknown message type may cause a reference
to uninitialized memory resulting in a null pointer dereference (CWE-476) or
dangling pointer (CWE-825), possibly crashing the system or causing heap
corruption.
https://www.cve.org/CVERecord?id=CVE-2008-0062
CVE-2008-5183 Chain: unchecked return value can lead to NULL dereference
https://www.cve.org/CVERecord?id=CVE-2008-5183
CVE-2004-0079 SSL software allows remote attackers to cause a denial of service (crash) via a
crafted SSL/TLS handshake that triggers a null dereference.
CWE Version 4.14
CWE-476: NULL Pointer Dereference
CWE-476: NULL Pointer Dereference