Common Weakness Enumeration
CWE-476
AllowedNULL Pointer Dereference
Abstraction: Base · Status: Stable
The product dereferences a pointer that it expects to be valid but is NULL.
6340 vulnerabilities reference this CWE, most recent first.
GHSA-6GV8-P3VJ-PXVR
Vulnerability from github – Published: 2021-08-25 14:43 – Updated: 2024-11-13 17:23
VLAI
Summary
Null pointer dereference in `UncompressElement`
Details
Impact
The code for tf.raw_ops.UncompressElement can be made to trigger a null pointer dereference:
import tensorflow as tf
data = tf.data.Dataset.from_tensors([0.0])
tf.raw_ops.UncompressElement(
compressed=tf.data.experimental.to_variant(data),
output_types=[tf.int64],
output_shapes=[2])
The implementation obtains a pointer to a CompressedElement from a Variant tensor and then proceeds to dereference it for decompressing. There is no check that the Variant tensor contained a CompressedElement, so the pointer is actually nullptr.
Patches
We have patched the issue in GitHub commit 7bdf50bb4f5c54a4997c379092888546c97c3ebd.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-cpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0"
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "tensorflow-gpu"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.5.0"
]
}
],
"aliases": [
"CVE-2021-37649"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-23T21:14:27Z",
"nvd_published_at": "2021-08-12T19:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nThe code for `tf.raw_ops.UncompressElement` can be made to trigger a null pointer dereference: \n\n```python\nimport tensorflow as tf\n\ndata = tf.data.Dataset.from_tensors([0.0])\ntf.raw_ops.UncompressElement(\n compressed=tf.data.experimental.to_variant(data),\n output_types=[tf.int64],\n output_shapes=[2])\n```\n \nThe [implementation](https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/data/experimental/compression_ops.cc#L50-L53) obtains a pointer to a `CompressedElement` from a `Variant` tensor and then proceeds to dereference it for decompressing. There is no check that the `Variant` tensor contained a `CompressedElement`, so the pointer is actually `nullptr`.\n\n### Patches\nWe have patched the issue in GitHub commit [7bdf50bb4f5c54a4997c379092888546c97c3ebd](https://github.com/tensorflow/tensorflow/commit/7bdf50bb4f5c54a4997c379092888546c97c3ebd).\n\nThe fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by members of the Aivul Team from Qihoo 360.",
"id": "GHSA-6gv8-p3vj-pxvr",
"modified": "2024-11-13T17:23:51Z",
"published": "2021-08-25T14:43:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6gv8-p3vj-pxvr"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37649"
},
{
"type": "WEB",
"url": "https://github.com/tensorflow/tensorflow/commit/7bdf50bb4f5c54a4997c379092888546c97c3ebd"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-562.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-760.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-271.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/tensorflow/tensorflow"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Null pointer dereference in `UncompressElement`"
}
GHSA-6GX3-9944-XMMR
Vulnerability from github – Published: 2024-10-21 21:30 – Updated: 2024-10-25 18:30
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
ASoC: soc-pcm: Add NULL check in BE reparenting
Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-48992"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-21T20:15:11Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: soc-pcm: Add NULL check in BE reparenting\n\nAdd NULL check in dpcm_be_reparent API, to handle\nkernel NULL pointer dereference error.\nThe issue occurred in fuzzing test.",
"id": "GHSA-6gx3-9944-xmmr",
"modified": "2024-10-25T18:30:48Z",
"published": "2024-10-21T21:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48992"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0760acc2e6598ad4f7bd3662db2d907ef0838139"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/34a9796bf0684bfd54e96a142560d560c21c983b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9f74b9aa8d58c18927bb9b65dd5ba70a5fd61615"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d4dd21a79dbb862d2ebcf9ed90e646416009ff0d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/db8f91d424fe0ea6db337aca8bc05908bbce1498"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e7166d6821c15f3516bcac8ae3f155924da1908c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f2ba66d8738584d124aff4e760ed1337f5f6dfb6"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f6f45e538328df9ce66aa61bafee1a5717c4b700"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6GX5-FPWH-H99M
Vulnerability from github – Published: 2022-05-14 01:39 – Updated: 2022-05-14 01:39
VLAI
Details
An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2019-6137"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-11T17:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in lib60870 2.1.1. LinkLayer_setAddress in link_layer/link_layer.c has a NULL pointer dereference.",
"id": "GHSA-6gx5-fpwh-h99m",
"modified": "2022-05-14T01:39:14Z",
"published": "2022-05-14T01:39:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-6137"
},
{
"type": "WEB",
"url": "https://github.com/mz-automation/lib60870/issues/39"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6H2G-R5XM-682C
Vulnerability from github – Published: 2022-05-17 00:20 – Updated: 2022-05-17 00:20
VLAI
Details
The Node_ValidatePtr function in corec/corec/node/node.c in mkclean 0.8.9 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-12803"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-10T02:29:00Z",
"severity": "MODERATE"
},
"details": "The Node_ValidatePtr function in corec/corec/node/node.c in mkclean 0.8.9 allows remote attackers to cause a denial of service (assert fault) via a crafted mkv file.",
"id": "GHSA-6h2g-r5xm-682c",
"modified": "2022-05-17T00:20:54Z",
"published": "2022-05-17T00:20:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12803"
},
{
"type": "WEB",
"url": "https://github.com/Matroska-Org/foundation-source/issues/24"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/144902/mkvalidator-0.5.1-Denial-Of-Service.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Nov/19"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6H2P-G88J-GCM9
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-01-06 18:31
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Fix NULL pointer dereference in capture_engine
When the intel_context structure contains NULL, it raises a NULL pointer dereference error in drm_info().
(cherry picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d)
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-56667"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T15:15:26Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Fix NULL pointer dereference in capture_engine\n\nWhen the intel_context structure contains NULL,\nit raises a NULL pointer dereference error in drm_info().\n\n(cherry picked from commit 754302a5bc1bd8fd3b7d85c168b0a1af6d4bba4d)",
"id": "GHSA-6h2p-g88j-gcm9",
"modified": "2025-01-06T18:31:00Z",
"published": "2024-12-27T15:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56667"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da0b986256ae9a78b0215214ff44f271bfe237c1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e07f9c92bd127f8835ac669d83b5e7ff59bbb40f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e6ebe4f14a267bc431d0eebab4f335c0ebd45977"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6H7G-9JF3-8CR5
Vulnerability from github – Published: 2022-05-17 02:57 – Updated: 2025-04-20 03:33
VLAI
Details
base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-5854"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-01T15:59:00Z",
"severity": "MODERATE"
},
"details": "base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.",
"id": "GHSA-6h7g-9jf3-8cr5",
"modified": "2025-04-20T03:33:28Z",
"published": "2022-05-17T02:57:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5854"
},
{
"type": "WEB",
"url": "https://blogs.gentoo.org/ago/2017/02/01/podofo-null-pointer-dereference-in-pdfoutputstream-cpp"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/01/14"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/12"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96072"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6HCF-G6GR-HHCR
Vulnerability from github – Published: 2023-03-24 22:01 – Updated: 2023-03-24 22:01
VLAI
Summary
`openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference
Details
These functions would crash when the context argument was None with certain extension types.
Thanks to David Benjamin (Google) for reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "openssl"
},
"ranges": [
{
"events": [
{
"introduced": "0.9.7"
},
{
"fixed": "0.10.48"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": true,
"github_reviewed_at": "2023-03-24T22:01:23Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "These functions would crash when the context argument was None with certain extension types.\n\nThanks to David Benjamin (Google) for reporting this issue.\n",
"id": "GHSA-6hcf-g6gr-hhcr",
"modified": "2023-03-24T22:01:23Z",
"published": "2023-03-24T22:01:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sfackler/rust-openssl/pull/1854"
},
{
"type": "PACKAGE",
"url": "https://github.com/sfackler/rust-openssl"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2023-0024.html"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "`openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference"
}
GHSA-6HCP-52XR-V4MV
Vulnerability from github – Published: 2022-11-29 00:30 – Updated: 2025-04-14 18:31
VLAI
Details
A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-4127"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-28T22:15:00Z",
"severity": "MODERATE"
},
"details": "A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service.",
"id": "GHSA-6hcp-52xr-v4mv",
"modified": "2025-04-14T18:31:41Z",
"published": "2022-11-29T00:30:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4127"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/d785a773bed966a75ca1f11d108ae1897189975b"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/all/d5a19c1e-9968-e22e-5917-c3139c5e7e89%40kernel.dk"
},
{
"type": "WEB",
"url": "https://lore.kernel.org/all/d5a19c1e-9968-e22e-5917-c3139c5e7e89@kernel.dk"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6HCP-X8FR-RWCV
Vulnerability from github – Published: 2025-04-03 09:32 – Updated: 2025-04-10 18:32
VLAI
Details
In the Linux kernel, the following vulnerability has been resolved:
firmware: qcom: uefisecapp: fix efivars registration race
Since the conversion to using the TZ allocator, the efivars service is registered before the memory pool has been allocated, something which can lead to a NULL-pointer dereference in case of a racing EFI variable access.
Make sure that all resources have been set up before registering the efivars.
Severity
4.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-21998"
],
"database_specific": {
"cwe_ids": [
"CWE-367",
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-03T08:15:15Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: qcom: uefisecapp: fix efivars registration race\n\nSince the conversion to using the TZ allocator, the efivars service is\nregistered before the memory pool has been allocated, something which\ncan lead to a NULL-pointer dereference in case of a racing EFI variable\naccess.\n\nMake sure that all resources have been set up before registering the\nefivars.",
"id": "GHSA-6hcp-x8fr-rwcv",
"modified": "2025-04-10T18:32:01Z",
"published": "2025-04-03T09:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21998"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c4e37b381a7a243c298a4858fc0a5a74e737c79a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/da8d493a80993972c427002684d0742560f3be4a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f15a2b96a0e41c426c63a932d0e63cde7b9784aa"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6HCQ-7FXG-HVVV
Vulnerability from github – Published: 2022-05-14 03:07 – Updated: 2025-04-20 03:43
VLAI
Details
The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2017-11185"
],
"database_specific": {
"cwe_ids": [
"CWE-476"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-18T17:29:00Z",
"severity": "HIGH"
},
"details": "The gmp plugin in strongSwan before 5.6.0 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted RSA signature.",
"id": "GHSA-6hcq-7fxg-hvvv",
"modified": "2025-04-20T03:43:17Z",
"published": "2022-05-14T03:07:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11185"
},
{
"type": "WEB",
"url": "https://www.strongswan.org/blog/2017/08/14/strongswan-vulnerability-%28cve-2017-11185%29.html"
},
{
"type": "WEB",
"url": "https://www.strongswan.org/blog/2017/08/14/strongswan-vulnerability-(cve-2017-11185).html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3962"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100492"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-56
Implementation
For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
Mitigation
Requirements
Select a programming language that is not susceptible to these issues.
Mitigation
Implementation
Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
Mitigation
Architecture and Design
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
Mitigation
Implementation
Explicitly initialize all variables and other data stores, either during declaration or just before the first usage.
No CAPEC attack patterns related to this CWE.