Tên: Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

Thông tin chung

Các cách xuất hiện

Implementation

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Confidentiality	Read Memory, Read Application Data Ghi chú: When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
Availability	DoS: Crash, Exit, or Restart, DoS: Instability Ghi chú: The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
Other	Unexpected State, Varies by Context Ghi chú: The consequences vary depending on the type of resource and how it is used within the product.

Ví dụ đã quan sát

Tài liệu tham khảo	Mô tả
CVE-2019-9805	Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.
CVE-2008-4197	Use of uninitialized memory may allow code execution.
CVE-2008-2934	Free of an uninitialized pointer leads to crash and possible code execution.
CVE-2008-0063	Product does not clear memory contents when generating an error message, leading to information leak.
CVE-2008-0062	Lack of initialization triggers NULL pointer dereference or double-free.
CVE-2008-0081	Uninitialized variable leads to code execution in popular desktop application.
CVE-2008-3688	Chain: Uninitialized variable leads to infinite loop.
CVE-2008-3475	Chain: Improper initialization leads to memory corruption.
CVE-2005-1036	Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap
CVE-2008-3597	Chain: game server can access player data structures before initialization has happened leading to NULL dereference
CVE-2009-2692	Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476).
CVE-2009-0949	Chain: improper initialization of memory can lead to NULL dereference
CVE-2009-3620	Chain: some unprivileged ioctls do not verify that a structure has been initialized before invocation, leading to NULL dereference
CVE-2008-5021	Composite: race condition (CWE-362) allows attacker to modify an object while it is still being initialized, causing software to access uninitialized memory (CWE-908).

Các biện pháp giảm thiểu tiềm năng

Phases : Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Phases : Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Phases : Implementation
Avoid race conditions (CWE-362) during initialization routines.
Phases : Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.

Phương pháp phát hiện

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Hiệu quả : High

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Tài liệu tham khảo

REF-436

Exploiting Uninitialized Data
mercy.
https://web.archive.org/web/20070403193636/http://www.felinemenace.org/~mercy/papers/UBehavior/UBehavior.zip

REF-1534

Automated Technical Debt Measure, Version 2
OMG.
https://www.omg.org/spec/ATDM2/1.0/PDF

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
CWE Content Team	MITRE	2012-12-21 +00:00	2013-02-21 +00:00	2.4

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2017-11-08 +00:00	updated Taxonomy_Mappings
CWE Content Team	MITRE	2019-01-03 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Description, Relationships
CWE Content Team	MITRE	2020-08-20 +00:00	updated Relationships
CWE Content Team	MITRE	2020-12-10 +00:00	updated Relationships
CWE Content Team	MITRE	2021-03-15 +00:00	updated Demonstrative_Examples, Observed_Examples
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description, Potential_Mitigations
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-09-09 +00:00	updated References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Detection_Factors, Observed_Examples
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, References

Chi tiết CWE-908

CWE-908