Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-561:Dead Code
Weakness ID:561
Version:v4.17
Weakness Name:Dead Code
Vulnerability Mapping:Allowed
Abstraction:Base
Structure:Simple
Status:Draft
Likelihood of Exploit:
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The product contains dead code, which can never be executed.

▼Extended Description

Dead code is code that can never be executed in a running program. The surrounding code makes it impossible for a section of code to ever be executed.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
ChildOfAllowed-with-ReviewC1164Irrelevant Code
ParentOfAllowedB570Expression is Always False
ParentOfAllowedB571Expression is Always True
Nature: ChildOf
Mapping: Allowed-with-Review
Type: Class
ID: 1164
Name: Irrelevant Code
Nature: ParentOf
Mapping: Allowed
Type: Base
ID: 570
Name: Expression is Always False
Nature: ParentOf
Mapping: Allowed
Type: Base
ID: 571
Name: Expression is Always True
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC747CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)
MemberOfProhibitedC883CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)
MemberOfProhibitedV884CWE Cross-section
MemberOfProhibitedC886SFP Primary Cluster: Unused entities
MemberOfProhibitedC1006Bad Coding Practices
MemberOfProhibitedC1130CISQ Quality Measures (2016) - Maintainability
MemberOfProhibitedC1186SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)
MemberOfProhibitedC1307CISQ Quality Measures - Maintainability
MemberOfProhibitedC1412Comprehensive Categorization: Poor Coding Practices
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 747
Name: CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 883
Name: CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)
Nature: MemberOf
Mapping: Prohibited
Type:View
ID: 884
Name: CWE Cross-section
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 886
Name: SFP Primary Cluster: Unused entities
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1006
Name: Bad Coding Practices
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1130
Name: CISQ Quality Measures (2016) - Maintainability
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1186
Name: SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1307
Name: CISQ Quality Measures - Maintainability
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1412
Name: Comprehensive Categorization: Poor Coding Practices
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-294Not Language-Specific Weaknesses
MemberOfProhibitedBSBOSS-310Reduce Maintainability (impact)
MemberOfProhibitedBSBOSS-325Quality Degradation (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-294
Name: Not Language-Specific Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-310
Name: Reduce Maintainability (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-325
Name: Quality Degradation (impact)
▼Relevant To View
Relevant to the view"CISQ Quality Measures (2020) - (1305)"
NatureMappingTypeIDName
MemberOfProhibitedC1307CISQ Quality Measures - Maintainability
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1307
Name: CISQ Quality Measures - Maintainability
Relevant to the view"Software Development - (699)"
NatureMappingTypeIDName
MemberOfProhibitedC1006Bad Coding Practices
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1006
Name: Bad Coding Practices
Relevant to the view"Weaknesses Addressed by the SEI CERT Perl Coding Standard - (1178)"
NatureMappingTypeIDName
MemberOfProhibitedC1186SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1186
Name: SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC886SFP Primary Cluster: Unused entities
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 886
Name: SFP Primary Cluster: Unused entities
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
OtherN/AQuality Degradation

Dead code that results from code that can never be executed is an indication of problems with the source code that needs to be fixed and is an indication of poor quality.

OtherN/AReduce Maintainability
N/A
Scope: Other
Likelihood: N/A
Impact: Quality Degradation
Note:

Dead code that results from code that can never be executed is an indication of problems with the source code that needs to be fixed and is an indication of poor quality.

Scope: Other
Likelihood: N/A
Impact: Reduce Maintainability
Note:
N/A
▼Potential Mitigations
Phase:Implementation
Mitigation ID:
Strategy:
Effectiveness:
Description:

Remove dead code before deploying the application.

Note:

Phase:Testing
Mitigation ID:
Strategy:
Effectiveness:
Description:

Use a static analysis tool to spot dead code.

Note:

▼Modes Of Introduction
Phase: Implementation
Note:

N/A

▼Applicable Platforms
Languages
Class: Not Language-Specific(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

The condition for the second if statement is impossible to satisfy. It requires that the variables be non-null. However, on the only path where s can be assigned a non-null value, there is a return statement.

Language: ( code)
N/A

Language: C++(Bad code)
String s = null; if (b) { s = "Yes"; return; } if (s != null) { Dead(); }

Example 2

In the following class, two private methods call each other, but since neither one is ever invoked from anywhere else, they are both dead code.

Language: ( code)
N/A

Language: Java(Bad code)
public class DoubleDead { private void doTweedledee() { doTweedledumb(); } private void doTweedledumb() { doTweedledee(); } public static void main(String[] args) { System.out.println("running DoubleDead"); } }

Language: ( code)
N/A

(In this case it is a good thing that the methods are dead: invoking either one would cause an infinite loop.)

Example 3

The field named glue is not used in the following class. The author of the class has accidentally put quotes around the field name, transforming it into a string constant.

Language: ( code)
N/A

Language: Java(Bad code)
public class Dead { String glue; public String getGlue() { return "glue"; } }

▼Observed Examples
ReferenceDescription
CVE-2014-1266
chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
Reference: CVE-2014-1266
Description:
chain: incorrect "goto" in Apple SSL product bypasses certificate validation, allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug). CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) -> CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      Indirect
      N/A
      Ordinality: Indirect
      Description:
      N/A
      ▼Detection Methods
      Architecture or Design Review
      Detection Method ID:
      Description:

      According to SOAR, the following detection techniques may be useful:

      ``` Highly cost effective: ```

      Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) Formal Methods / Correct-By-Construction ``` Cost effective for partial coverage: ```

      Attack Modeling

      Effectiveness:High
      Note:

      N/A

      Automated Static Analysis - Binary or Bytecode
      Detection Method ID:
      Description:

      According to SOAR, the following detection techniques may be useful:

      ``` Highly cost effective: ```

      Binary / Bytecode Quality Analysis Compare binary / bytecode to application permission manifest

      Effectiveness:High
      Note:

      N/A

      Dynamic Analysis with Manual Results Interpretation
      Detection Method ID:
      Description:

      According to SOAR, the following detection techniques may be useful:

      ``` Cost effective for partial coverage: ```

      Automated Monitored Execution

      Effectiveness:SOAR Partial
      Note:

      N/A

      Automated Static Analysis
      Detection Method ID:
      Description:

      According to SOAR, the following detection techniques may be useful:

      ``` Cost effective for partial coverage: ```

      Permission Manifest Analysis

      Effectiveness:SOAR Partial
      Note:

      N/A

      Automated Static Analysis - Source Code
      Detection Method ID:
      Description:

      According to SOAR, the following detection techniques may be useful:

      ``` Highly cost effective: ```

      Source Code Quality Analyzer ``` Cost effective for partial coverage: ```

      Warning Flags Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer

      Effectiveness:High
      Note:

      N/A

      Dynamic Analysis with Automated Results Interpretation
      Detection Method ID:
      Description:

      According to SOAR, the following detection techniques may be useful:

      ``` Cost effective for partial coverage: ```

      Web Application Scanner Web Services Scanner Database Scanners

      Effectiveness:SOAR Partial
      Note:

      N/A

      Manual Static Analysis - Source Code
      Detection Method ID:
      Description:

      According to SOAR, the following detection techniques may be useful:

      ``` Highly cost effective: ```

      Manual Source Code Review (not inspections) ``` Cost effective for partial coverage: ```

      Focused Manual Spotcheck - Focused manual analysis of source

      Effectiveness:High
      Note:

      N/A

      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      CERT C Secure CodingMSC07-CN/ADetect and remove dead code
      SEI CERT Perl Coding StandardMSC00-PLExactDetect and remove dead code
      Software Fault PatternsSFP2N/AUnused Entities
      OMG ASCMMASCMM-MNT-20N/AN/A
      Taxonomy Name: CERT C Secure Coding
      Entry ID: MSC07-C
      Fit: N/A
      Entry Name: Detect and remove dead code
      Taxonomy Name: SEI CERT Perl Coding Standard
      Entry ID: MSC00-PL
      Fit: Exact
      Entry Name: Detect and remove dead code
      Taxonomy Name: Software Fault Patterns
      Entry ID: SFP2
      Fit: N/A
      Entry Name: Unused Entities
      Taxonomy Name: OMG ASCMM
      Entry ID: ASCMM-MNT-20
      Fit: N/A
      Entry Name: N/A
      ▼Related Attack Patterns
      IDName
      ▼References
      Reference ID: REF-960
      Title: Automated Source Code Maintainability Measure (ASCMM)
      Author: Object Management Group (OMG)
      Section: ASCMM-MNT-20
      Publication:
      Publisher:
      Edition:
      URL:https://www.omg.org/spec/ASCMM/
      URL Date:2023-04-07
      Day:N/A
      Month:01
      Year:2016
      Details not found