CWE-908Use of Uninitialized Resource

Description

The product uses or accesses a resource that has not been initialized.

Common consequences

• Confidentiality→Read Memory,Read Application Data
  When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party.
• Availability→DoS: Crash, Exit, or Restart,DoS: Instability
  The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash.
• Other→Unexpected State,Varies by Context
  The consequences vary depending on the type of resource and how it is used within the product.

Potential mitigations

• Implementation
  Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
• Implementation
  Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
• Implementation
  Avoid race conditions (CWE-362) during initialization routines.
• Build and Compilation
  Run or compile the product with settings that generate warnings about uninitialized variables or data.

Related CWEs

Recent CVEs classified under this CWE