Incorrect Check of Function Return Value

Opis

The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.

Important and common functions will return some value about the success of its actions. This will alert the program whether or not to handle any errors caused by that function.

Skutki

• Availability, Integrity

  Unexpected State; DoS: Crash, Exit, or Restart

  An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.

Zapobieganie

• Architecture and Design · Language Selection

  Use a language or compiler that uses exceptions and requires the catching of those exceptions.

• Implementation

  Properly check all functions which return a value.

• Implementation

  When designing any function make sure you return a value or throw an exception in case of an error.

Przykłady podatności

• CVE-2023-49286 Chain: function in web caching proxy does not correctly check a return value (CWE-253) leading to a reachable assertion (CWE-617)

Słabość nadrzędna

• CWE-573 Improper Following of Specification by Caller
• CWE-754 Improper Check for Unusual or Exceptional Conditions

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Not Technology-Specific

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 7, "Return Value Testing and Interpretation", Page 340, Addison Wesley, 2006
2. The CLASP Application Security Process — Secure Software, Inc., 2005