A NULL pointer dereference occurs when the application
dereferences a pointer that it expects to be valid, but is NULL, typically
causing a crash or exit.
Time of Introduction
Implementation
Applicable Platforms
Languages
C
C++
Java
.NET
Common Consequences
Scope
Effect
Availability
NULL pointer dereferences usually result in the failure of the
process.
In very rare circumstances and environments, code execution is
possible.
Likelihood of Exploit
Medium
Demonstrative Examples
Example 1
NULL pointer dereference issue can occur through a number of flaws,
including race conditions, and simple programming omissions. While there are
no complete fixes aside from conscientious programming, the following steps
will go a long way to ensure that NULL pointer dereferences do not occur.
Before using a pointer, ensure that it is not equal to NULL:
(Good Code)
C
if (pointer1 != NULL) {
/* make use of pointer1 */
/* ... */
}
When freeing pointers, ensure they are not set to NULL, and be sure to
set them to NULL once they are freed:
(Good Code)
C
if (pointer1 != NULL) {
free(pointer1);
pointer1 = NULL;
}
If you are working with a multi-threaded or otherwise asynchronous
environment, ensure that proper locking APIs are used to lock before the
if statement; and unlock when it has finished.
Example 2
In the following code, the programmer assumes that the system always
has a property named "cmd" defined. If an attacker can control the program's
environment so that "cmd" is not defined, the program throws a NULL pointer
exception when it attempts to call the trim() method.
race condition causes a table to be corrupted if a
timer activates while it is being modified, leading to resultant NULL
dereference; also involves locking.
Requirements specification: The choice could be made to use a language
that is not susceptible to these issues.
Implementation
If all pointers that could have been modified are sanity-checked
previous to use, nearly all NULL pointer dereferences can be
prevented.
Other Notes
NULL pointer dereferences, while common, can generally be found and
corrected in a simply way. They will always result in the crash of the
process unless exception handling (on some platforms) is invoked, and even
then, little can be done to salvage the process.
NULL pointer dereferences are frequently resultant from rarely encountered
error conditions, since these are most likely to escape detection during the
testing phases.
Weakness Ordinalities
Ordinality
Description
Resultant
(where the
weakness is typically related to the presence of some other
weaknesses)
Description
