Description
The software encounters an error but does not provide a status code or return value to indicate that an error has occurred.
Modes of Introduction:
– Architecture and Design
Related Weaknesses
CWE-684
CWE-703
CWE-703
CWE-703
Consequences
Integrity, Other: Varies by Context, Unexpected State
Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.
Potential Mitigations
CVE References
- CVE-2004-0063
- Function returns “OK” even if another function returns a different status code than expected, leading to accepting an invalid PIN number.
- CVE-2002-1446
- Error checking routine in PKCS#11 library returns “OK” status even when invalid signature is detected, allowing spoofed messages.
- CVE-2002-0499
- Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory.
- CVE-2005-2459
- Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.
