CWE-476: NULL Pointer Dereference

Description:
The product dereferences a pointer that it expects to be valid but is NULL.

Affected languages: C, C++, Java, C#, Go
Parent weaknesses: CWE-710, CWE-754, CWE-754

Consequences:
  - Availability: DoS: Crash, Exit, or Restart
  - Integrity: Execute Unauthorized Code or Commands

Detection methods:
  - Automated Dynamic Analysis: This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, a
  - Manual Dynamic Analysis: Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the program under low memory conditions, run with insufficient privileges or permissions, 
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin
  - Automated Dynamic Analysis: Use tools that are integrated during
	     compilation to insert runtime error-checking mechanisms
	     related to memory safety errors, such as AddressSanitizer
	     (ASan) for C/C++ [REF-1518].

Mitigations:
  - [Implementation] For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has f
  - [Requirements] Select a programming language that is not susceptible to these issues.
  - [Implementation] Check the results of all functions that return a value and verify that the value is non-null before acting upon it.
  - [Architecture and Design] Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.

Demonstrative examples:
This example takes an IP address from a user, verifies that it is well formed and then looks up the hostname and copies it into a buffer.
If an attacker provides an address that appears to be well-formed, but the address does not resolve to a hostname, then the call to gethostbyaddr() will return NULL. Since the code does not check the return value from gethostbyaddr (CWE-252), a NULL pointer dereference (CWE-476) would then occur in the call to strcpy().
void host_lookup(char *user_supplied_addr){ 
                         struct hostent *hp; in_addr_t *addr; char hostname[64]; in_addr_t inet_addr(const char *cp); 
                            
                            /*routine that ensures user_supplied_addr is in the right format for conversion */ 
                            
      

In the following code, the programmer assumes that the system always has a property named "cmd" defined. If an attacker can control the program's environment so that "cmd" is not defined, the program throws a NULL pointer exception when it attempts to call the trim() method.

String cmd = System.getProperty("cmd"); cmd = cmd.trim();

Real-world examples:
  - CVE-2024-41130: C++ library for LLM inference has NULL pointer dereference if a read operation fails
  - CVE-2005-3274: race condition causes a table to be corrupted if a timer activates while it is being modified, leading to resultant NULL dereference; also involves locking.
  - CVE-2002-1912: large number of packets leads to NULL dereference
  - CVE-2005-0772: packet with invalid error status value triggers NULL dereference
  - CVE-2009-4895: Chain: race condition for an argument value, possibly resulting in NULL dereference