null pointer dereference

term

programmingsecurity

Following a pointer that holds null, so the program reads or writes address zero and is stopped by the operating system.

PRIME calls this the zero pointer, and the usual cause is prosaic: a function returned null on failure and nobody checked. On modern systems it is a reliable crash rather than a takeover, because the zero page is deliberately left unmapped, which is precisely the mitigation, and it explains why the same bug was far more dangerous on older systems where low memory could be mapped. Its real cost is availability, since an attacker who can force the null path repeatedly has a denial of service. It is CWE-476, and in a debugger it is the fastest bug to diagnose: the backtrace names the line.

Also known as: zero pointer, null deref, segfault, CWE-476

All glossary entries