Description

The software encounters an error but does not provide a status code or return value to indicate that an error has occurred.

Modes of Introduction:

– Architecture and Design

Related Weaknesses

CWE-684
CWE-703
CWE-703
CWE-703

Consequences

Integrity, Other: Varies by Context, Unexpected State

Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.

Potential Mitigations

CVE References

• CVE-2004-0063
  • Function returns “OK” even if another function returns a different status code than expected, leading to accepting an invalid PIN number.

• CVE-2002-1446
  • Error checking routine in PKCS#11 library returns “OK” status even when invalid signature is detected, allowing spoofed messages.

• CVE-2002-0499
  • Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory.

• CVE-2005-2459
  • Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.