Finding unhandled errors using CodeQL

Summary: Trail of Bits used CodeQL variant analysis to hunt unhandled error codes in a Windows/Visual Studio codebase, starting from a custom error type called CustomErrorType and building a query that flags call sites where the returned error never taints a branching condition. Their local taint-tracking query returned slightly over 100 code locations after filtering unit tests, while a global taint-tracking version ran in about 20 seconds to compile and 10 seconds to run on a 2020 Intel i5 MacBook Pro and produced over 200 results, narrowed to around 150 after excluding response-generating calls.
Key Takeaway: The article cites CVE-2018-1002105, a critical Kubernetes vulnerability in which incorrectly handled errors let attackers establish a back-end connection through the Kubernetes API - the same class of mistake a manual code review would likely miss across a large codebase.

Read the original at Trail of Bits Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-1002105
Related: Demystifying Kubernetes CVE-2018-1002105 (and a dead simple exploit) Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026