CWE-908Use of Uninitialized Resource

Description

The product uses or accesses a resource that has not been initialized.

When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.

Common consequences

• Confidentiality→Read Memory,Read Application Data
  When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.
• Availability→DoS: Crash, Exit, or Restart
  The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend.

Potential mitigations

• Implementation
  Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
• Implementation
  Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
• Implementation
  Avoid race conditions (CWE-362) during initialization routines.
• Build and Compilation
  Run or compile the product with settings that generate warnings about uninitialized variables or data.

Related CWEs

Recent CVEs classified under this CWE