Improper Handling of Exceptional Conditions

Opis

The product does not handle or incorrectly handles an exceptional condition.

Skutki

• Other

  Other

Przykłady podatności

• CVE-2023-41151 SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error
• CVE-2021-3011 virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
• CVE-2008-4302 Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.

Słabość nadrzędna

• CWE-703 Improper Check or Handling of Exceptional Conditions

Słabości podrzędne

• CWE-209 Generation of Error Message Containing Sensitive Information
• CWE-248 Uncaught Exception
• CWE-274 Improper Handling of Insufficient Privileges
• CWE-280 Improper Handling of Insufficient Permissions or Privileges
• CWE-333 Improper Handling of Insufficient Entropy in TRNG
• CWE-390 Detection of Error Condition Without Action
• CWE-392 Missing Report of Error Condition
• CWE-395 Use of NullPointerException Catch to Detect NULL Pointer Dereference
• CWE-396 Declaration of Catch for Generic Exception
• CWE-460 Improper Cleanup on Thrown Exception
• CWE-544 Missing Standardized Error Handling Mechanism
• CWE-636 Not Failing Securely ('Failing Open')
• CWE-756 Missing Custom Error Page

Kiedy powstaje

• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Źródła

1. Randstorm: You Can't Patch a House of Cards — Unciphered, 2023