Uncaught Exception

Opis

An exception is thrown from a function, but it is not caught.

When an exception is not caught, it may cause the program to crash or expose sensitive information.

Skutki

• Availability, Confidentiality

  DoS: Crash, Exit, or Restart; Read Application Data

  An uncaught exception could cause the system to be placed in a state that could lead to a crash, exposure of sensitive information or other unintended behaviors.

Przykłady podatności

• CVE-2023-41151 SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error
• CVE-2023-21087 Java code in a smartphone OS can encounter a "boot loop" due to an uncaught exception

Słabość nadrzędna

• CWE-705 Incorrect Control Flow Scoping
• CWE-755 Improper Handling of Exceptional Conditions
• CWE-703 Improper Check or Handling of Exceptional Conditions

Słabości podrzędne

• CWE-600 Uncaught Exception in Servlet

Kiedy powstaje

• Implementation

Dotyczy

C++, Java, C#

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005