Weakness (CWE)
CWE-252: Unchecked Return Value
The product does not check the return value from a method or function.
How to prevent it (4 mitigations)
-
Implementation
Check the results of all functions that return a value and verify that the value is expected.
-
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
-
Implementation
Ensure that you account for all possible return values from the function.
-
Implementation
When designing a function, make sure you return a value or throw an exception in case of an error.
Source: MITRE CWE-252
151 results · Feed
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kf…
-
High 7.5
ProtoNode may be modified such that common method calls may panic in ipfs/go-merkledag
go-merkledag implements the 'DAGService' interface and adds two ipld node types, Protobuf and Raw for the ipfs project. A `ProtoNode` may be modified in such a way as to cause various encode errors which will trigger a panic on common method calls that don't …
-
High 7.5
Unchecked return value from xmlTextReaderExpand in Nokogiri
Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextReaderExpand` in the method `Nokogiri::XML::Reader#attribute_hash`. This can lead to a null pointer e…
-
Critical 9.1
Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Sn…
-
High 7.5
An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wme…
-
Medium 6.5
HashiCorp Consul vulnerable to authorization bypass
HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enabling leverage of privileged access to bypass service mesh intentions. Fixed in 1.11.9, 1.12.5, and 1.13…
-
Low 3.0
Dell BIOS versions contain an Unchecked Return Value vulnerability. A local authenticated administrator user could pote…
-
Unscored —
A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those pack…
-
Unscored —
A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd …
-
Medium 5.3
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The…
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way …
-
High 7.5
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `false`. `ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and u…
-
High 7.5
Invalid file request can crashe parse-server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server in…
-
Medium 5.9
Denial of Service (DoS)
This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a function), and then it will crash with type-check.
-
Medium 5.5
Unchecked return value in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially ena…
-
Unscored —
In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification …
-
Unscored —
A use after return issue was found in Opensc before version 0.22.0 in insert_pin function that could potentially crash …
-
Medium 6.7
Unchecked return value in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable e…
-
Critical 10.0
A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and …
-
Medium 4.2
Misconfigured IP address field in ROA leads to OctoRPKI crash
If the ROA that a repository returns contains too many bits for the IP address then OctoRPKI will crash.
-
High 7.5
CODESYS V2 web server: crafted requests could trigger a pointer dereference with an invalid address (DoS)
In the CODESYS V2 web server prior to V1.1.9.22 crafted web server requests can trigger a parser error. Since the parser result is not checked under all conditions, a pointer dereference with an invalid address can occur. This leads to a denial of service sit…
-
Medium 6.5
Junos OS: MX Series: In subscriber management / BBE configuration authd can crash if a subscriber with a specific username tries to login leading to a DoS
An Unchecked Return Value vulnerability in the authd (authentication daemon) of Juniper Networks Junos OS on MX Series configured for subscriber management / BBE allows an adjacent attacker to cause a crash by sending a specific username. This impacts authent…
-
High 7.5
Incorrect Check of Function Return Value in Skytable
Skytable is an open source NoSQL database. In versions prior to 0.6.4 an incorrect check of return value of the accept function in the run-loop for a TCP socket/TLS socket/TCP+TLS multi-socket causes an early exit from the run loop that should continue infini…
-
Medium 5.5
Pillow denial of service
An issue was discovered in Pillow before 8.2.0. PSDImagePlugin.PsdImageFile lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on Image.open prior to Image.load.
-
Critical 9.8
Out of bounds read in xcb
An issue was discovered in the xcb crate through 2021-02-04 for Rust. It has a soundness violation because xcb::xproto::GetAtomNameReply::name() calls std::str::from_utf8_unchecked() on unvalidated bytes from an X server.
-
High 8.1CVE-2020-17533 Public exploit
Apache Accumulo Improper Handling of Insufficient Permissions
Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy enforcement functions before permitting an authenticated user to perform certain administrative operations. Specifically, the return values o…
-
Medium 5.3
Undefined behavior in Tensorflow
In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind to `nullptr` while setting a `status` variable to the error condition. However, this `status` argum…
-
Critical 9.8
A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A sp…
-
Medium 5.3
A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3. The return value of makefd_xpr…
-
Critical 9.8
Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute ar…
-
High 7.5
Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does not properly check the return values of various file and …