1729
Terminology
Many weaknesses related to pointer dereferences fall under the general term of "memory
corruption" or "memory safety." As of September 2010, there is no commonly-used terminology
that covers the lower-level variants.
Related Attack Patterns
CAPEC-ID Attack Pattern Name
129 Pointer Manipulation
References
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-824: Access of Uninitialized Pointer
Weakness ID : 824
Structure : Simple
Abstraction : Base
Description
The product accesses or uses a pointer that has not been initialized.
Extended Description
If the pointer contains an uninitialized value, then the value might not point to a valid memory
location. This could cause the product to read from or write to unexpected memory locations,
leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary
functions could be invoked. If an attacker can influence the portion of uninitialized memory that
is contained in the pointer, this weakness could be leveraged to execute code or perform other
attacks.
Depending on memory layout, associated memory management behaviors, and product operation,
the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more
fine-grained control of the memory location to be accessed.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 119 Improper Restriction of Operations within the Bounds of a
Memory Buffer