CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

• Confidentiality: Read Memory, Read Application Data — When reusing a resource such as memory or a program variable, the original contents may not have been cleared before it is sent to an untrusted party. • Availability: DoS: Crash, Exit, or Restart, DoS: Instability — The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend, possibly leading to a crash. • Other: Unexpected State, Varies by Context — The consequences vary depending on the type of resource and how it is used within the product.

• [Implementation] Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps. • [Implementation] Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization. • [Implementation] Avoid race conditions (CWE-362) during initialization routines. • [Build and Compilation] Run or compile the product with settings that generate warnings about uninitialized variables or data.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2019-9805: Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption. • CVE-2008-4197: Use of uninitialized memory may allow code execution. • CVE-2008-2934: Free of an uninitialized pointer leads to crash and possible code execution. • CVE-2008-0063: Product does not clear memory contents when generating an error message, leading to information leak. • CVE-2008-0062: Lack of initialization triggers NULL pointer dereference or double-free. • CVE-2008-0081: Uninitialized variable leads to code execution in popular desktop application. • CVE-2008-3688: Chain: Uninitialized variable leads to infinite loop. • CVE-2008-3475: Chain: Improper initialization leads to memory corruption. • CVE-2005-1036: Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap • CVE-2008-3597: Chain: game server can access player data structures before initialization has happened leading to NULL dereference • CVE-2009-2692: Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476). • CVE-2009-0949: Chain: improper initialization of memory can lead to NULL dereference • CVE-2009-3620: Chain: some unprivileged ioctls do not verify that a structure has been initialized before invocation, leading to NULL dereference • CVE-2008-5021: Composite: race condition (CWE-362) allows attacker to modify an object while it is still being initialized, causing software to access uninitialized memory (CWE-908).