Szczegóły CWE-561

CWE-561

Dead Code
Draft
2006-07-19
00h00 +00:00
2025-12-11
00h00 +00:00
CWE Mitre.org
Powiadomienia dla konkretnego CWE
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CWE.
Zarządzaj powiadomieniami

Nazwa: Dead Code

The product contains dead code, which can never be executed.

Opis CWE

Dead code is code that can never be executed in a running program. The surrounding code makes it impossible for a section of code to ever be executed.

Informacje ogólne

Sposoby wprowadzenia

Implementation

Odpowiednie platformy

Język

Class: Not Language-Specific (Undetermined)

Typowe konsekwencje

Zakres Wpływ Prawdopodobieństwo
OtherQuality Degradation

Note: Dead code that results from code that can never be executed is an indication of problems with the source code that needs to be fixed and is an indication of poor quality.
OtherReduce Maintainability

Zaobserwowane przykłady

Odniesienia Opis

CVE-2014-1266

Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

Potencjalne środki zaradcze

Phases : Implementation
Remove dead code before deploying the application.
Phases : Testing
Use a static analysis tool to spot dead code.

Metody wykrywania

Architecture or Design Review

Skuteczność : High

Automated Static Analysis - Binary or Bytecode

Skuteczność : High

Dynamic Analysis with Manual Results Interpretation

Skuteczność : SOAR Partial

Automated Static Analysis

Skuteczność : SOAR Partial

Automated Static Analysis - Source Code

Skuteczność : High

Dynamic Analysis with Automated Results Interpretation

Skuteczność : SOAR Partial

Manual Static Analysis - Source Code

Skuteczność : High

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Odniesienia

REF-960

Automated Source Code Maintainability Measure (ASCMM)
Object Management Group (OMG).
https://www.omg.org/spec/ASCMM/

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

Zgłoszenie

Nazwa Organizacja Data Data wydania Version
Anonymous Tool Vendor (under NDA) 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

Modyfikacje

Nazwa Organizacja Data Komentarz
Eric Dalci Cigital 2008-07-01 +00:00 updated Potential_Mitigations, Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Description, Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team MITRE 2008-11-24 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2009-05-27 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2009-07-27 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2009-10-29 +00:00 updated Common_Consequences, Other_Notes
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2011-09-13 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2012-05-11 +00:00 updated Common_Consequences, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2014-06-23 +00:00 updated Observed_Examples
CWE Content Team MITRE 2014-07-30 +00:00 updated Detection_Factors, Taxonomy_Mappings
CWE Content Team MITRE 2017-11-08 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2019-01-03 +00:00 updated Common_Consequences, References, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
CWE Content Team MITRE 2019-06-20 +00:00 updated Type
CWE Content Team MITRE 2020-02-24 +00:00 updated Applicable_Platforms, Observed_Examples, Relationships
CWE Content Team MITRE 2020-08-20 +00:00 updated Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated Relationships
CWE Content Team MITRE 2021-07-20 +00:00 updated Observed_Examples
CWE Content Team MITRE 2023-01-31 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2025-09-09 +00:00 updated Detection_Factors, References
CWE Content Team MITRE 2025-12-11 +00:00 updated Observed_Examples
Informacje prezentowane na CVE Find pochodzą z kilku starannie wybranych źródeł referencyjnych. Dane CVE są dostarczane przez MITRE Corporation i Narodową Bazę Podatności (NVD). Katalog znanych eksploatowanych podatności (KEV) pochodzi z Agencji ds. Bezpieczeństwa Cyberprzestrzeni i Infrastruktury (CISA), natomiast wyniki EPSS pochodzą z FIRST.org. Ponadto dane dotyczące słabości oprogramowania (CWE) i typowych wzorców ataków (CAPEC) są utrzymywane przez MITRE Corporation, a informacje o konfiguracjach sprzętu i oprogramowania (CPE) są dostarczane przez NVD.