Description
The software uses or accesses a resource that has not been initialized.
When a resource has not been properly initialized, the software may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the software.
Modes of Introduction:
– Implementation
Likelihood of Exploit: Medium
Related Weaknesses
Consequences
Confidentiality: Read Memory, Read Application Data
When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
Availability: DoS: Crash, Exit, or Restart
The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend.
Potential Mitigations
Phase: Implementation
Effectiveness:
Description:
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Phase: Implementation
Effectiveness:
Description:
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Phase: Implementation
Effectiveness:
Description:
Avoid race conditions (CWE-362) during initialization routines.
Phase: Build and Compilation
Effectiveness:
Description:
Run or compile the software with settings that generate warnings about uninitialized variables or data.
CVE References
- CVE-2019-9805
- Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.
- CVE-2008-4197
- Use of uninitialized memory may allow code execution.
- CVE-2008-2934
- Free of an uninitialized pointer leads to crash and possible code execution.
- CVE-2008-0063
- Product does not clear memory contents when generating an error message, leading to information leak.
- CVE-2008-0062
- Lack of initialization triggers NULL pointer dereference or double-free.
- CVE-2008-0081
- Uninitialized variable leads to code execution in popular desktop application.
- CVE-2008-3688
- Chain: Uninitialized variable leads to infinite loop.
- CVE-2008-3475
- Chain: Improper initialization leads to memory corruption.
- CVE-2005-1036
- Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap
- CVE-2008-3597
- Chain: game server can access player data structures before initialization has happened leading to NULL dereference
- CVE-2009-2692
- Chain: uninitialized function pointers can be dereferenced allowing code execution
- CVE-2009-0949
- Chain: improper initialization of memory can lead to NULL dereference
- CVE-2009-3620
- Chain: some unprivileged ioctls do not verify that a structure has been initialized before invocation, leading to NULL dereference