CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
How it's found
Unchecked Return Value is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
Vulnerable vs. safe
/* access shared resource */pthread_mutex_lock(mutex);pthread_mutex_unlock(mutex);void f(pthread_mutex_t *mutex) {}return result;/* access shared resource */int result;result = pthread_mutex_lock(mutex);if (0 != result)return pthread_mutex_unlock(mutex);int f(pthread_mutex_t *mutex) {}Consequences
- Unexpected State, DoS: Crash, Exit, or Restart: An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.
Mitigations
- Implementation: Check the results of all functions that return a value and verify that the value is expected.
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Implementation: Ensure that you account for all possible return values from the function.
- Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-252?
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
How do you find Unchecked Return Value?
Unchecked Return Value is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-252?
Unexpected State, DoS: Crash, Exit, or Restart: An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.
Does TurboPentest test for Unchecked Return Value?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
- Class weaknessCWE-754: Improper Check for Unusual or Exceptional Conditions
- Base weaknessCWE-203: Observable Discrepancy
- Base weaknessCWE-209: Generation of Error Message Containing Sensitive Information
- Class weaknessCWE-228: Improper Handling of Syntactically Invalid Structure
- Base weaknessCWE-391: Unchecked Error Condition
- Class weaknessCWE-636: Failing Open
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest