VNX-455: Non-exit on Failed Initialization

Reports C/C++ code that tests an initialisation call (sodium_init, curl_global_init, pthread_mutex_init, a project's own *_init) for failure and then only logs, so execution continues with an uninitialised library, context or lock.

Field	Value
Rule ID	`VNX-455`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	C, C++
CWE	CWE-455
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`non-exit-on-failed-init` `cwe-455` `error-handling`
Source	`internal/sast/rules/vnx-455.rego`

Overview

VNX-455 maps to CWE-455: Non-exit on Failed Initialization. It reports an if whose condition tests an init/setup/startup function for failure (!f(), < 0, == NULL, != *_OK…), directly or through a status variable assigned from the call just above, when the failure branch consists only of printf/fprintf/perror/syslog/std::cerr/log/warn statements. A failure branch that exits, returns, aborts, throws or sets a fallback, a success test that logs, and is*/has*Initialized predicates are not reported.

Why This Matters

Code that runs after a failed initialisation uses a library, random-number generator, TLS context or lock in an undefined state. A crypto library that did not initialise can hand out predictable keys; a mutex that did not initialise does not exclude anyone.

What Gets Flagged

// FLAGGED: failure is only logged
if (sodium_init() < 0) {
    fprintf(stderr, "libsodium init failed\n");
}
generate_keys();

// NOT FLAGGED: the program stops
if (sodium_init() < 0) {
    fprintf(stderr, "libsodium init failed\n");
    exit(1);
}

Remediation

Exit, return an error or abort in the failure branch of every initialisation check.
If a fallback is genuinely possible, record it in state that later code checks.
For confirmed false positives, add a // vulnetix-ignore: VNX-455 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-455
// nosec vnx-455

Or record an ignore rule: vulnetix ignore add --rule vnx-455 --reason "...". See Suppressing findings.