CWE-690: Unchecked Return Value to NULL Pointer Dereference

Code Examples & CVEs

Demonstrative Examples

The code below makes a call to the getUserName() function but doesn't check the return value before dereferencing (which may cause a NullPointerException).

BadJava

String username = getUserName();if (username.equals(ADMIN_USER)) {...}

This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.

If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy().

BadC

void host_lookup(char *user_supplied_addr){                         struct hostent *hp;in_addr_t *addr;char hostname[64];in_addr_t inet_addr(const char *cp);                                                        /*routine that ensures user_supplied_addr is in the right format for conversion */                                                        validate_addr_form(user_supplied_addr);addr = inet_addr(user_supplied_addr);hp = gethostbyaddr( addr, sizeof(struct in_addr), AF_INET);strcpy(hostname, hp->h_name);                      }

Observed CVE Examples (5)

CVE-2008-1052

Large Content-Length value leads to NULL pointer dereference when malloc fails.

View Details

CVE-2006-6227

Large message length field leads to NULL pointer dereference when malloc fails.

View Details

CVE-2006-2555

Parsing routine encounters NULL dereference when input is missing a colon separator.

View Details

CVE-2003-1054

URI parsing API sets argument to NULL when a parsing failure occurs, such as when the Referer header is missing a hostname, leading to NULL dereference.

View Details

CVE-2008-5183

chain: unchecked return value can lead to NULL dereference

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Detect Unchecked Return Value to NULL Pointer Dereference with Black Box

Documented detection approaches include Black Box, White Box, and Automated Dynamic Analysis; recorded impacts include DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands, Read Memory, and Modify Memory; observed examples include CVE-2008-1052, CVE-2006-6227, and CVE-2006-2555. Use these source-defined anchors to turn CWE-690 into implementation, review, and verification checks for the affected component.

CWE-690: Unchecked Return Value to NULL Pointer Dereference — MITRE CWE

Prevent CWE-690 through an SSDF control plan

Use NIST SSDF practices to make prevention of CWE-690, Unchecked Return Value to NULL Pointer Dereference, an explicit development outcome. Translate the CWE definition into security requirements and design constraints, choose safer implementation patterns and toolchain checks, and define acceptance evidence before release. Feed every confirmed occurrence back into the requirements, design review, and coding rules so the same root cause is removed across the product rather than patched in one location.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Triage CWE-690 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-690, Unchecked Return Value to NULL Pointer Dereference, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-690

Apply MITRE's full root-cause mapping guidance when using CWE-690, Unchecked Return Value to NULL Pointer Dereference. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-690 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-690, Unchecked Return Value to NULL Pointer Dereference. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-690: Unchecked Return Value to NULL Pointer Dereference?+

CWE-690: Unchecked Return Value to NULL Pointer Dereference is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not check for an error after calling a function that can return with a NULL pointer if the function fails, which leads to a resultant NULL pointer dereference. While unchecked return value weaknesses are not limited to returns of NULL pointers (see the examples in CWE-252), functions often return NULL to indicate an error status. When this error condition is not checked, a NULL pointer dereference can occur.

What are the security consequences of Unchecked Return Value to NULL Pointer Dereference?+

If exploited, CWE-690 (Unchecked Return Value to NULL Pointer Dereference) it can compromise Availability, Integrity and Confidentiality, leading to outcomes such as DoS: Crash, Exit, or Restart, Execute Unauthorized Code or Commands, Read Memory and Modify Memory.

How is Unchecked Return Value to NULL Pointer Dereference detected?+

CWE-690 can be detected using Black Box and White Box. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Unchecked Return Value to NULL Pointer Dereference?+

CWE-690 commonly affects C, C++ and Memory-Unsafe. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Unchecked Return Value to NULL Pointer Dereference?+

MITRE documents real CVEs mapped to CWE-690, including CVE-2008-1052, CVE-2006-6227, CVE-2006-2555, CVE-2003-1054 and CVE-2008-5183. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-690 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-690: Unchecked Return Value to NULL Pointer Dereference

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Scope

Impact

Mitigation Strategies

Detection Methods

Method

Description

Method

Description

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (5)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Detect Unchecked Return Value to NULL Pointer Dereference with Black Box

Prevent CWE-690 through an SSDF control plan

Triage CWE-690 against known exploitation evidence

Apply precise root-cause mapping to CWE-690

Validate CWE-690 with root-cause mapping checks

Frequently Asked Questions

Learn More