CWE-390 Base Borrador Medium likelihood

Detection of Error Condition Without Action

This weakness occurs when software successfully identifies an error condition but then fails to take any meaningful action to address it. The error is detected but ignored, leaving the system in an…

Definición

What is CWE-390?

This weakness occurs when software successfully identifies an error condition but then fails to take any meaningful action to address it. The error is detected but ignored, leaving the system in an inconsistent or vulnerable state.
Imagine your code checks for a failed login attempt, a missing file, or a network timeout, but then simply logs the event and continues normal execution as if nothing went wrong. This creates a silent failure where the root problem isn't corrected, and the application might proceed using bad data, null pointers, or unstable connections. The core issue is that detection logic is present, but the crucial response—like rolling back a transaction, showing a user-friendly alert, or falling back to a secure default—is completely missing. For developers, this often stems from placeholder error handling, such as empty `catch` blocks or generic logging statements that don't trigger remediation. To fix it, every error check must have a defined outcome: terminate the operation safely, retry with limitations, notify the user appropriately, or revert to a known good state. Treating error detection as a separate step from the response action leaves critical security and stability gaps that attackers or unexpected conditions can easily exploit.
Impacto en el mundo real

Real-world CVEs caused by CWE-390

  • CVE-2022-21820

    A GPU data center manager detects an error due to a malformed request but does not act on it, leading to memory corruption.

Cómo lo explotan los atacantes

Ruta del atacante paso a paso

  1. 1

    The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.

  2. 2

    The conditional successfully detects a NULL return value from malloc indicating a failure, however it does not do anything to handle the problem. Unhandled errors may have unexpected results and may cause the program to crash or terminate.

  3. 3

    Instead, the if block should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following example notifies the user that the malloc function did not allocate the required memory resources and returns an error code.

  4. 4

    In the following C++ example the method readFile() will read the file whose name is provided in the input parameter and will return the contents of the file in char string. The method calls open() and read() may result in errors if the file does not exist or does not contain any data to read. These errors will be thrown when the is_open() method and good() method indicate errors opening or reading the file. However, these errors are not handled within the catch statement. Catch statements that do not perform any processing will have unexpected results. In this case an empty char string will be returned, and the file will not be properly closed.

  5. 5

    The catch statement should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following C++ example contains two catch statements. The first of these will catch a specific error thrown within the try block, and the second catch statement will catch all other errors from within the catch block. Both catch statements will notify the user that an error has occurred, close the file, and rethrow to the block that called the readFile() method for further handling or possible termination of the program.

Ejemplo de código vulnerable

Vulnerable C

The following example attempts to allocate memory for a character. After the call to malloc, an if statement is used to check whether the malloc function failed.

Vulnerable C 
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
  if (foo==NULL) {
  	//We do nothing so we just ignore the error.
  }
Ejemplo de código seguro

Secure C

Instead, the if block should contain statements that either attempt to fix the problem or notify the user that an error has occurred and continue processing or perform some cleanup and gracefully terminate the program. The following example notifies the user that the malloc function did not allocate the required memory resources and returns an error code.

Seguro C 
foo=malloc(sizeof(char)); //the next line checks to see if malloc failed
  if (foo==NULL) {
  	printf("Malloc failed to allocate memory resources");
  	return -1;
  }
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Lista de prevención

How to prevent CWE-390

  • Implementation Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment.
  • Implementation If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.
  • Testing Subject the product to extensive testing to discover some of the possible instances of where/how errors or return values are not handled. Consider testing techniques such as ad hoc, equivalence partitioning, robustness and fault tolerance, mutation, and fuzzing.
Señales de detección

How to detect CWE-390

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Auto-corrección de Plexicus

Plexicus detecta automáticamente CWE-390 y abre un PR de corrección en menos de 60 segundos.

Codex Remedium escanea cada commit, identifica esta debilidad concreta y entrega un pull request listo para revisión con el parche. Sin tickets. Sin traspasos.

Solicitar demo Probar Plexicus gratis
Preguntas frecuentes

Frequently asked questions

¿Qué es CWE-390?

This weakness occurs when software successfully identifies an error condition but then fails to take any meaningful action to address it. The error is detected but ignored, leaving the system in an inconsistent or vulnerable state.

¿Qué gravedad tiene CWE-390?

MITRE califica la probabilidad de explotación como Media — la explotación es realista pero suele requerir condiciones específicas.

¿Qué lenguajes o plataformas se ven afectados por CWE-390?

MITRE no ha especificado plataformas afectadas para esta CWE — puede aplicar a la mayoría de los stacks de aplicaciones.

¿Cómo puedo prevenir CWE-390?

Properly handle each exception. This is the recommended solution. Ensure that all exceptions are handled in such a way that you can be sure of the state of your system at any given moment. If a function returns an error, it is important to either fix the problem and try again, alert the user that an error has happened and let the program continue, or alert the user and close and cleanup the program.

¿Cómo detecta y corrige Plexicus CWE-390?

El motor SAST de Plexicus detecta la firma de flujo de datos para CWE-390 en cada commit. Cuando hay coincidencia, nuestro agente Codex Remedium abre un PR de corrección con el código corregido, las pruebas y un resumen de una línea para el revisor.

¿Dónde puedo aprender más sobre CWE-390?

MITRE publica la definición canónica en https://cwe.mitre.org/data/definitions/390.html. También puedes consultar la documentación de OWASP y NIST para guías relacionadas.

Debilidades relacionadas

Weaknesses related to CWE-390

CWE-755 Padre

Improper Handling of Exceptional Conditions

This vulnerability occurs when software fails to properly manage unexpected situations or errors, leaving it in an unstable or insecure…

CWE-209 Hermano

Generation of Error Message Containing Sensitive Information

This vulnerability occurs when an application reveals sensitive details about its internal systems, user data, or environment within error…

CWE-248 Hermano

Uncaught Exception

This vulnerability occurs when a function throws an error or exception, but the calling code does not have a proper handler to catch and…

CWE-274 Hermano

Improper Handling of Insufficient Privileges

This vulnerability occurs when an application fails to properly manage situations where it lacks the necessary permissions to execute an…

CWE-280 Hermano

Improper Handling of Insufficient Permissions or Privileges

This vulnerability occurs when a system fails to properly manage situations where it lacks the necessary permissions to perform an action…

CWE-333 Hermano

Improper Handling of Insufficient Entropy in TRNG

This vulnerability occurs when a system fails to properly manage the limited or unpredictable output rate of a true random number…

CWE-392 Hermano

Missing Report of Error Condition

This vulnerability occurs when a system fails to properly signal that an error has happened. Instead of returning a clear error code,…

CWE-395 Hermano

Use of NullPointerException Catch to Detect NULL Pointer Dereference

Using a try-catch block for NullPointerException as a substitute for proper null checks is an anti-pattern. This approach masks the root…

CWE-396 Hermano

Declaration of Catch for Generic Exception

This weakness occurs when code catches a generic exception type like 'Exception' or 'Throwable', which can hide specific errors and create…

Recursos

Further reading

Listo cuando tú lo estés

Deja de pagar por desarrollador.
Empieza a cerrar el bucle.

Plexicus es el ASPM nativo de IA que escanea, filtra, corrige, pentestea y explica — de forma autónoma. Desarrolladores ilimitados, repos ilimitados, acciones de IA de uso justo. Nivel gratuito real, €269/mo anual cuando estés listo.

Comenzar gratis Reservar una demo