Missing Initialization of a Variable

Opis

The product does not initialize critical variables, which causes the execution environment to use unexpected values.

Skutki

• Integrity, Other

  Unexpected State; Quality Degradation; Varies by Context

  The uninitialized data may be invalid, causing logic errors within the program. In some cases, this could result in a security problem.

Zapobieganie

• Implementation · Attack Surface Reduction

  Ensure that critical variables are initialized before first use [REF-1485].

• Requirements · Language Selection

  Choose a language that is not susceptible to these issues.

Przykłady podatności

• CVE-2020-6078 Chain: The return value of a function returning a pointer is not checked for success (CWE-252) resulting in the later use of an uninitialized variable (CWE-456) and a null pointer dereference (CWE-476)
• CVE-2019-3836 Chain: secure communications library does not initialize a local variable for a data structure (CWE-456), leading to access of an uninitialized pointer (CWE-824).
• CVE-2018-14641 Chain: C union member is not initialized (CWE-456), leading to access of invalid pointer (CWE-824)
• CVE-2009-2692 Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476)
• CVE-2020-20739 A variable that has its value set in a conditional statement is sometimes used when the conditional fails, sometimes causing data leakage
• CVE-2005-2978 Product uses uninitialized variables for size and index, leading to resultant buffer overflow.
• CVE-2005-2109 Internal variable in PHP application is not initialized, allowing external modification.
• CVE-2005-2193 Array variable not initialized in PHP application, leading to resultant SQL injection.

Słabość nadrzędna

• CWE-909 Missing Initialization of Resource
• CWE-665 Improper Initialization

Może prowadzić do

• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
• CWE-457 Use of Uninitialized Variable

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific

Uwagi

This weakness is a major factor in a number of resultant weaknesses, especially in web applications that allow global variable initialization (such as PHP) with libraries that can be directly requested.

It is highly likely that a large number of resultant weaknesses have missing initialization as a primary factor, but researcher reports generally do not provide this level of detail.

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 7, "Variable Initialization", Page 312, Addison Wesley, 2006
2. Automated Source Code Reliability Measure (ASCRM) — Object Management Group (OMG), ASCRM-CWE-456, 2016
3. Automated Source Code Security Measure (ASCSM) — Object Management Group (OMG), ASCSM-CWE-456, 2016
4. uninitialized variable vulnerability - Problem with boolean variables that are forcibly initialized to false by the Java compiler — windshock, 2022
5. The Java Language Specification, Java SE 7 Edition — James Gosling, Bill Joy, Guy Steele, Gilad Bracha, Alex Buckley, 2013
6. D3FEND: D3-VI Variable Initialization — D3FEND