CWE-392 – Missing Report of Error Condition

Read Time:48 Second

Description

The software encounters an error but does not provide a status code or return value to indicate that an error has occurred.

Modes of Introduction:

– Architecture and Design

 

 

Related Weaknesses

CWE-684
CWE-703
CWE-703
CWE-703

 

Consequences

Integrity, Other: Varies by Context, Unexpected State

Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.

 

Potential Mitigations

CVE References

  • CVE-2004-0063
    • Function returns “OK” even if another function returns a different status code than expected, leading to accepting an invalid PIN number.
  • CVE-2002-1446
    • Error checking routine in PKCS#11 library returns “OK” status even when invalid signature is detected, allowing spoofed messages.
  • CVE-2002-0499
    • Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory.
  • CVE-2005-2459
    • Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.