CWE-908: Use of Uninitialized Resource (Base)

Description: The product uses or accesses a resource that has not been initialized.

Extended Description: When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.



Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Implementation::



Common Consequences: ::SCOPE:Confidentiality:IMPACT:Read Memory:IMPACT:Read Application Data:NOTE:When reusing a resource such as memory or a program variable, the original contents of that resource may not be cleared before it is sent to an untrusted party.::SCOPE:Availability:IMPACT:DoS: Crash, Exit, or Restart:NOTE:The uninitialized resource may contain values that cause program flow to change in ways that the programmer did not intend.::


Potential Mitigations: ::PHASE:Implementation:DESCRIPTION:Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.::PHASE:Implementation:DESCRIPTION:Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.::PHASE:Implementation:DESCRIPTION:Avoid race conditions (CWE-362) during initialization routines.::PHASE:Build and Compilation:DESCRIPTION:Run or compile the product with settings that generate warnings about uninitialized variables or data.::

Observed Examples: ::REFERENCE:CVE-2019-9805:DESCRIPTION:Chain: Creation of the packet client occurs before initialization is complete (CWE-696) resulting in a read from uninitialized memory (CWE-908), causing memory corruption.:LINK:https://www.cve.org/CVERecord?id=CVE-2019-9805::REFERENCE:CVE-2008-4197:DESCRIPTION:Use of uninitialized memory may allow code execution.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-4197::REFERENCE:CVE-2008-2934:DESCRIPTION:Free of an uninitialized pointer leads to crash and possible code execution.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-2934::REFERENCE:CVE-2008-0063:DESCRIPTION:Product does not clear memory contents when generating an error message, leading to information leak.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-0063::REFERENCE:CVE-2008-0062:DESCRIPTION:Lack of initialization triggers NULL pointer dereference or double-free.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-0062::REFERENCE:CVE-2008-0081:DESCRIPTION:Uninitialized variable leads to code execution in popular desktop application.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-0081::REFERENCE:CVE-2008-3688:DESCRIPTION:Chain: Uninitialized variable leads to infinite loop.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-3688::REFERENCE:CVE-2008-3475:DESCRIPTION:Chain: Improper initialization leads to memory corruption.:LINK:https://www.cve.org/CVERecord?id=CVE-2008-3475::REFERENCE:CVE-2005-1036:DESCRIPTION:Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap:LINK:https://www.cve.org/CVERecord?id=CVE-2005-1036::REFERENCE:CVE-2008-3597:DESCRIPTION:Chain: game server can access player data structures before initialization has happened leading to NULL dereference:LINK:https://www.cve.org/CVERecord?id=CVE-2008-3597::REFERENCE:CVE-2009-2692:DESCRIPTION:Chain: uninitialized function pointers can be dereferenced allowing code execution:LINK:https://www.cve.org/CVERecord?id=CVE-2009-2692::REFERENCE:CVE-2009-0949:DESCRIPTION:Chain: improper initialization of memory can lead to NULL dereference:LINK:https://www.cve.org/CVERecord?id=CVE-2009-0949::REFERENCE:CVE-2009-3620:DESCRIPTION:Chain: some unprivileged ioctls do not verify that a structure has been initialized before invocation, leading to NULL dereference:LINK:https://www.cve.org/CVERecord?id=CVE-2009-3620::