1798
Scope Impact Likelihood
Confidentiality Read Memory
Read Application Data
When reusing a resource such as memory or a program
variable, the original contents of that resource may not be
cleared before it is sent to an untrusted party.
Availability DoS: Crash, Exit, or Restart
The uninitialized resource may contain values that cause
program flow to change in ways that the programmer did
not intend.
Potential Mitigations
Phase: Implementation
Explicitly initialize the resource before use. If this is performed through an API function or
standard procedure, follow all specified steps.
Phase: Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might
not perform the initialization.
Phase: Implementation
Avoid race conditions (CWE-362) during initialization routines.
Phase: Build and Compilation
Run or compile your product with settings that generate warnings about uninitialized variables or
data.
Demonstrative Examples
Example 1:
Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed
once. However, the field is mistakenly set to true during static initialization, so the initialization code
is never reached.
Example Language: Java (Bad)
private boolean initialized = true;
public void someMethod() {
if (!initialized) {
// perform initialization tasks
...
initialized = true;
}
Example 2:
The following code intends to limit certain operations to the administrator only.
Example Language: Perl (Bad)
$username = GetCurrentUser();
$state = GetStateData($username);
if (defined($state)) {
$uid = ExtractUserID($state);
}
# do stuff
if ($uid == 0) {
DoAdminThings();
}
CWE Version 4.14
CWE-909: Missing Initialization of Resource
CWE-909: Missing Initialization of Resource