CWE-392 Missing Report of Error Condition

The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.

• Integrity, Other: Varies by Context, Unexpected State — Errors that are not properly reported could place the system in an unexpected state that could lead to unintended behaviors.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2024-52316: Web-based product can throw an exception during authentication but does not report the failure in the HTTP status code, allowing authentication bypass. • [REF-1374]: Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391) • CVE-2004-0063: Function returns "OK" even if another function returns a different status code than expected, leading to accepting an invalid PIN number. • CVE-2002-1446: Error checking routine in PKCS#11 library returns "OK" status even when invalid signature is detected, allowing spoofed messages. • CVE-2002-0499: Kernel function truncates long pathnames without generating an error, leading to operation on wrong directory. • CVE-2005-2459: Function returns non-error value when a particular erroneous condition is encountered, leading to resultant NULL dereference.