CWE-617Reachable Assertion

Description

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Common consequences

• Availability→DoS: Crash, Exit, or Restart
  While assertion is good for catching logic errors and reducing the chances of reaching more serious vulnerability conditions, an attacker can still cause a denial of service if they can trigger an assert statement, and if the scope of the a

Potential mitigations

• Implementation
  If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
• Implementation
  Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.
• Implementation
  Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)
• Implementation
  Perform input validation on user data.

Related CWEs

Recent CVEs classified under this CWE