1458
Scope Impact Likelihood
Read Application Data
When reusing a resource such as memory or a program
variable, the original contents of that resource may not be
cleared before it is sent to an untrusted party.
Access Control Bypass Protection Mechanism
If security-critical decisions rely on a variable having a
"0" or equivalent value, and the programming language
performs this initialization on behalf of the programmer,
then a bypass of security may occur.
Availability DoS: Crash, Exit, or Restart
The uninitialized data may contain values that cause
program flow to change in ways that the programmer did
not intend. For example, if an uninitialized variable is used
as an array index in C, then its previous contents may
produce an index that is outside the range of the array,
possibly causing a crash or an exit in other environments.
Detection Methods
Automated Dynamic Analysis
This weakness can be detected using dynamic tools and techniques that interact with the
software using large test suites with many diverse inputs, such as fuzz testing (fuzzing),
robustness testing, and fault injection. The software's operation may slow down, but it should not
become unstable, crash, or generate incorrect results. Initialization problems may be detected
with a stress-test by calling the software simultaneously from a large number of threads or
processes, and look for evidence of any unexpected behavior. The software's operation may
slow down, but it should not become unstable, crash, or generate incorrect results.
Effectiveness = Moderate
Manual Dynamic Analysis
Identify error conditions that are not likely to occur during normal usage and trigger them.
For example, run the program under low memory conditions, run with insufficient privileges
or permissions, interrupt a transaction before it is completed, or disable connectivity to basic
network services such as DNS. Monitor the software for any unexpected behavior. If you trigger
an unhandled exception or similar error that was discovered and handled by the application's
environment, it may still indicate unexpected conditions that were not handled by the application
itself.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Requirements
Strategy = Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make
this weakness easier to avoid. For example, in Java, if the programmer does not explicitly
CWE Version 4.14
CWE-665: Improper Initialization
CWE-665: Improper Initialization