CWE-755: Improper Handling of Exceptional Conditions

Description

The product does not handle or incorrectly handles an exceptional condition.

Potential Impact

Other

Demonstrative Examples

The following example attempts to resolve a hostname.

Bad

protected void doPost (HttpServletRequest req, HttpServletResponse res) throws IOException {String ip = req.getRemoteAddr();InetAddress addr = InetAddress.getByName(ip);...out.println("hello " + addr.getHostName());}

A DNS lookup failure will cause the Servlet to throw an exception.

The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.

Bad

foo=malloc(sizeof(char)); //the next line checks to see if malloc failedif (foo==NULL) {//We do nothing so we just ignore the error.}

The conditional successfully detects a NULL return value from malloc indicating a failure, however it does not do anything to handle the problem. Unhandled errors may have unexpected results and may cause the program to crash or terminate.

Instead, the if block should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following example notifies the user that the malloc function did not allocate the required memory resources and returns an error code.

Good

foo=malloc(sizeof(char)); //the next line checks to see if malloc failedif (foo==NULL) {printf("Malloc failed to allocate memory resources");return -1;}

The following code mistakenly catches a NullPointerException.

Bad

try {
				  
					mysteryMethod();
				  
				  } catch (NullPointerException npe) {
                  }

Detection Methods

Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

CVE ID	Description
CVE-2023-41151	SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error
[REF-1374]	Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generat
CVE-2021-3011	virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
CVE-2008-4302	Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.

Frequently Asked Questions

What is CWE-755?

CWE-755 (Improper Handling of Exceptional Conditions) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Class-level weakness. The product does not handle or incorrectly handles an exceptional condition.

How can CWE-755 be exploited?

Attackers can exploit CWE-755 (Improper Handling of Exceptional Conditions) to other. This weakness is typically introduced during the Implementation phase of software development.

How do I prevent CWE-755?

Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.

What is the severity of CWE-755?

CWE-755 is classified as a Class-level weakness (High abstraction). It has been observed in 4 real-world CVEs.