Description

The software does not initialize critical variables, which causes the execution environment to use unexpected values.

Modes of Introduction:

– Implementation

Related Weaknesses

CWE-909
CWE-665
CWE-665
CWE-89
CWE-120
CWE-98
CWE-457

Consequences

Integrity, Other: Unexpected State, Quality Degradation, Varies by Context

The uninitialized data may be invalid, causing logic errors within the program. In some cases, this could result in a security problem.

Potential Mitigations

Phase: Implementation

Description: 

Check that critical variables are initialized.

Phase: Testing

Description: 

Use a static analysis tool to spot non-initialized variables.

CVE References

• CVE-2020-6078
  • Chain: The return value of a function returning a pointer is not checked for success (CWE-252) resulting in the later use of an uninitialized variable (CWE-456) and a null pointer dereference (CWE-476)

• CVE-2009-2692
  • Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476).

• CVE-2020-20739
  • A variable that has its value set in a conditional statement is sometimes used when the conditional fails, sometimes causing data leakage

• CVE-2005-2978
  • Product uses uninitialized variables for size and index, leading to resultant buffer overflow.

• CVE-2005-2109
  • Internal variable in PHP application is not initialized, allowing external modification.

• CVE-2005-2193
  • Array variable not initialized in PHP application, leading to resultant SQL injection.