CWE-252: Unchecked Return Value
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
How it's found
Unchecked Return Value is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Two common programmer assumptions are "this function call can never fail" and "it doesn't matter if this function call fails". If an attacker can force the function to fail or otherwise return a value that is not expected, then the subsequent program logic could lead to a vulnerability, because the product is not in a state that the programmer assumes. For example, if the program calls a function to drop privileges but does not check the return code to ensure that privileges were successfully dropped, then the program will continue to operate with the higher privileges.
Vulnerable vs. safe
/* access shared resource */pthread_mutex_lock(mutex);pthread_mutex_unlock(mutex);void f(pthread_mutex_t *mutex) {}return result;/* access shared resource */int result;result = pthread_mutex_lock(mutex);if (0 != result)return pthread_mutex_unlock(mutex);int f(pthread_mutex_t *mutex) {}Consequences
- Unexpected State, DoS: Crash, Exit, or Restart: An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.
Mitigations
- Implementation: Check the results of all functions that return a value and verify that the value is expected.
- Implementation: For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
- Implementation: Ensure that you account for all possible return values from the function.
- Implementation: When designing a function, make sure you return a value or throw an exception in case of an error.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-252?
The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
How do you find Unchecked Return Value?
Unchecked Return Value is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-252?
Unexpected State, DoS: Crash, Exit, or Restart: An unexpected return value could place the system in a state that could lead to a crash or other unintended behaviors.
Does TurboPentest test for Unchecked Return Value?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
- Class weaknessCWE-754: Improper Check for Unusual or Exceptional Conditions
- Base weaknessCWE-203: Observable Discrepancy
- Base weaknessCWE-209: Generation of Error Message Containing Sensitive Information
- Class weaknessCWE-228: Improper Handling of Syntactically Invalid Structure
- Base weaknessCWE-391: Unchecked Error Condition
- Class weaknessCWE-636: Failing Open
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest