繁體中文

CWE-561 詳細資料

CWE-561

Dead Code
2006-07-19
00h00 +00:00
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
指定 CWE 通知
掌握特定 CWE 的任何變更。
管理通知

名稱: Dead Code

The product contains dead code, which can never be executed.

一般資訊

引入方式

Implementation

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

常見後果

範圍 影響 可能性
OtherQuality Degradation

注意：Dead code that results from code that can never be executed is an indication of problems with the source code that needs to be fixed and is an indication of poor quality.
OtherReduce Maintainability
OtherVaries by Context, Execute Unauthorized Code or Commands

注意：In some cases, dead code can be reachable or exploitable by attackers after they exploit another weakness or vulnerability that can access the code. For example, some buffer overflow exploits could modify addresses to point to locations that contain dead code.

觀察到的案例

參考資料 描述

CVE-2014-1266

Chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint). The code's whitespace indentation did not reflect the actual control flow (CWE-1114) and did not explicitly delimit the block (CWE-483), which could have made it more difficult for human code auditors to detect the vulnerability.

潛在緩解措施

Phases : Implementation
Remove dead code before deploying the application.

偵測方法

Architecture or Design Review

有效性 : High

Automated Static Analysis - Binary or Bytecode

有效性 : High

Dynamic Analysis with Manual Results Interpretation

有效性 : SOAR Partial

Automated Static Analysis

有效性 : SOAR Partial

Automated Static Analysis - Source Code

有效性 : High

Dynamic Analysis with Automated Results Interpretation

有效性 : SOAR Partial

Manual Static Analysis - Source Code

有效性 : High

漏洞對應備注

理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities. However, the term "dead code" might have multiple interpretations.
備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

備注



參考資料

REF-960

Automated Source Code Maintainability Measure (ASCMM)
Object Management Group (OMG).
https://www.omg.org/spec/ASCMM/

REF-1479

State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, Rama S. Moorthy.
https://www.ida.org/-/media/feature/publications/s/st/stateoftheart-resources-soar-for-software-vulnerability-detection-test-and-evaluation/p-5061.ashx

REF-1534

Automated Technical Debt Measure, Version 2
OMG.
https://www.omg.org/spec/ATDM2/1.0/PDF

提交

名稱 機構 日期 發布日期 Version
Anonymous Tool Vendor (under NDA) 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

修改記錄

名稱 機構 日期 備註
Eric Dalci Cigital 2008-07-01 +00:00 updated Potential_Mitigations, Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Description, Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team MITRE 2008-11-24 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2009-05-27 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2009-07-27 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2009-10-29 +00:00 updated Common_Consequences, Other_Notes
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2011-09-13 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2012-05-11 +00:00 updated Common_Consequences, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2014-06-23 +00:00 updated Observed_Examples
CWE Content Team MITRE 2014-07-30 +00:00 updated Detection_Factors, Taxonomy_Mappings
CWE Content Team MITRE 2017-11-08 +00:00 updated Relationships, Taxonomy_Mappings
CWE Content Team MITRE 2019-01-03 +00:00 updated Common_Consequences, References, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
CWE Content Team MITRE 2019-06-20 +00:00 updated Type
CWE Content Team MITRE 2020-02-24 +00:00 updated Applicable_Platforms, Observed_Examples, Relationships
CWE Content Team MITRE 2020-08-20 +00:00 updated Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated Relationships
CWE Content Team MITRE 2021-07-20 +00:00 updated Observed_Examples
CWE Content Team MITRE 2023-01-31 +00:00 updated Description
CWE Content Team MITRE 2023-04-27 +00:00 updated References, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2024-02-29 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2025-09-09 +00:00 updated Detection_Factors, References
CWE Content Team MITRE 2025-12-11 +00:00 updated Observed_Examples
CWE Content Team MITRE 2026-04-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2026-10-28 +00:00 updated Common_Consequences, Description, Mapping_Notes, References, Relationships, Technical_Nuance, Terminology_Notes
cvefind.com 上呈現的資訊來自多個精心挑選的參考來源。CVE 資料由 MITRE Corporation 和 國家漏洞資料庫（NVD）提供。已知被利用漏洞（KEV）目錄來自 網路安全暨基礎設施安全局（CISA），而 EPSS 評分來自 FIRST.org。此外，軟體弱點（CWE）和常見攻擊模式（CAPEC）的資料由 MITRE Corporation 維護，硬軟體配置（CPE）資訊由 NVD 提供。