Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-390 (未有动作错误条件的检测) — Vulnerability Class 14

14 vulnerabilities classified as CWE-390 (未有动作错误条件的检测). AI Chinese analysis included.

CWE-390 represents a critical logic flaw where software identifies an error condition but fails to execute any remedial action. This weakness typically arises when developers detect exceptions or invalid states but ignore them, allowing the program to continue execution with corrupted data or undefined behavior. Attackers exploit this by triggering the specific error condition, causing the application to proceed in an unstable state that may lead to data corruption, denial of service, or further vulnerabilities like buffer overflows. To prevent this, developers must implement robust error handling strategies that include logging the incident, notifying administrators, and safely terminating or resetting the process. Ensuring that every detected error triggers a defined response mechanism is essential for maintaining system integrity and preventing silent failures that compromise security and reliability.

MITRE CWE Description
The product detects a specific error, but takes no actions to handle the error.
Common Consequences (1)
Integrity, OtherVaries by Context, Unexpected State, Alter Execution Logic
An attacker could utilize an ignored error condition to place the system in an unexpected state that could lead to the execution of unintended logic and could cause other unintended behavior.
Mitigations (3)
ImplementationProperly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
ImplementationIf a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.
TestingSubject the product to extensive testing to discover some of the possible instances of where/how errors or return values are not handled. Consider testing techniques such as ad hoc, equivalence partitioning, robustness and fault tolerance, mutation, and fuzzing.
Examples (2)
The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed if (foo==NULL) { //We do nothing so we just ignore the error. }
Bad · C
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed if (foo==NULL) { printf("Malloc failed to allocate memory resources"); return -1; }
Good · C
In the following C++ example the method readFile() will read the file whose name is provided in the input parameter and will return the contents of the file in char string. The method calls open() and read() may result in errors if the file does not exist or does not contain any data to read. These errors will be thrown when the is_open() method and good() method indicate errors opening or reading…
char* readfile (char *filename) { try { // open input file ifstream infile; infile.open(filename); if (!infile.is_open()) { throw "Unable to open file " + filename; } // get length of file infile.seekg (0, ios::end); int length = infile.tellg(); infile.seekg (0, ios::beg); // allocate memory char *buffer = new char [length]; // read data from file infile.read (buffer,length); if (!infile.good()) { throw "Unable to read from file " + filename; } infile.close(); return buffer; } catch (...) { /* bug: insert code to handle this later */ } }
Bad · C++
char* readFile (char *filename) { try { // open input file ifstream infile; infile.open(filename); if (!infile.is_open()) { throw "Unable to open file " + filename; } // get length of file infile.seekg (0, ios::end); int length = infile.tellg(); infile.seekg (0, ios::beg); // allocate memory char *buffer = new char [length]; // read data from file infile.read (buffer,length); if (!infile.good()) { throw "Unable to read from file " + filename; } infile.close(); return buffer; } catch (char *str) { printf("Error: %s \n", str); infile.close(); throw str; } catch (...) { printf("Error occurred try
Good · C++

Vulnerabilities classified as CWE-390 (未有动作错误条件的检测) represent 14 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.