The software does not initialize or incorrectly initializes a
resource, which might leave the resource in an unexpected state when it is
accessed or used.
Extended Description
This can have security implications when the associated resource is
expected to have certain properties or values, such as a variable that
determines whether a user has been authenticated or not.
Time of Introduction
Implementation
Operation
Applicable Platforms
Languages
All
Modes of Introduction
This weakness can occur in code paths that are not well-tested, such as
rare error conditions. This is because the use of uninitialized data would
be noticed as a bug during frequently-used functionality.
Common Consequences
Scope
Effect
Confidentiality
When reusing a resource such as memory or a program variable, the
original contents of that resource may not be cleared before it is sent
to an untrusted party.
Integrity
If security-critical decisions rely on a variable having a "0" or
equivalent value, and the programming language performs this
initialization on behalf of the programmer, then a bypass of security
may occur.
Availability
The uninitialized data may contain values that cause program flow to
change in ways that the programmer did not intend. For example, if an
uninitialized variable is used as an array index in C, then its previous
contents may produce an index that is outside the range of the array,
possibly causing a crash or an exit in other environments.
Likelihood of Exploit
Medium
Demonstrative Examples
Example 1
Here, a boolean initiailized field is consulted to ensure that
initialization tasks are only completed once. However, the field is
mistakenly set to true during static initialization, so the initialization
code is never reached.
(Bad Code)
Java
private boolean initialized = true;
public void someMethod() {
if (!initialized) {
// perform initialization tasks
...
initialized = true;
}
Example 2
The following code intends to limit certain operations to the
administrator only.
(Bad Code)
Perl
$username = GetCurrentUser();
$state = GetStateData($username);
if (defined($state)) {
$uid = ExtractUserID($state);
}
# do stuff
if ($uid == 0) {
DoAdminThings();
}
If the application is unable to extract the state information - say,
due to a database timeout - then the $uid variable will not be
explicitly set by the programmer. This will cause $uid to be regarded as
equivalent to "0" in the conditional, allowing the original user to
perform administrator actions. Even if the attacker cannot directly
influence the state data, unexpected errors could cause incorrect
privileges to be assigned to a user just by accident.
Example 3
The following code intends to concatenate a string to a variable and
print the string.
(Bad Code)
C
char str[20];
strcat(str, "hello world");
printf("%s", str);
This might seem innocent enough, but str was not initialized, so it
contains random memory. As a result, str[0] might not contain the null
terminator, so the copy might start at an offset other than 0. The
consequences can vary, depending on the underlying memory.
If a null terminator is found before str[8], then some bytes of random
garbage will be printed before the "hello world" string. The memory
might contain sensitive information from previous uses, such as a
password (which might occur as a result of CWE-14 or CWE-244). In this
example, it might not be a big deal, but consider what could happen if
large amounts of memory are printed out before the null terminator is
found.
If a null terminator isn't found before str[8], then a buffer overflow
could occur, since strcat will first look for the null terminator, then
copy 12 bytes starting with that location. Alternately, a buffer
over-read might occur (CWE-126) if a null terminator isn't found before
the end of the memory segment is reached, leading to a segmentation
fault and crash.
Permission bitmap is not properly initialized,
leading to resultant privilege elevation or
DoS.
Potential Mitigations
Phase
Description
Requirements
Use a language with features that can automatically mitigate or
eliminate weaknesses related to initialization.
For example, in Java, if the programmer does not explicitly initialize
a variable, then the code could produce a compile-time error (if the
variable is local) or automatically initialize the variable to the
default value for the variable's type. In Perl, if explicit
initialization is not performed, then a default value of undef is
assigned, which is interpreted as 0, false, or an equivalent value
depending on the context in which the variable is accessed.
Architecture and Design
Identify all variables and data stores that receive information from
external sources, and apply input validation to make sure that they are
only initialized to expected values.
Implementation
Explicitly initialize all your variables and other data stores, either
during declaration or just before the first usage.
Implementation
Pay close attention to complex conditionals that affect
initialization, since some conditions might not perform the
initialization.
Implementation
Avoid race conditions (CWE-362) during initialization routines.
Build and Compilation
Run or compile your software with settings that generate warnings
about uninitialized variables or data.
Testing
Use automated static analysis tools that target this type of weakness.
Many modern techniques use data flow analysis to minimize the number of
false positives. This is not a perfect solution, since 100% accuracy and
coverage are not feasible.
Testing
Use dynamic tools and techniques that interact with the software using
large test suites with many diverse inputs, such as fuzz testing
(fuzzing), robustness testing, and fault injection. The software's
operation may slow down, but it should not become unstable, crash, or
generate incorrect results.
Testing
Stress-test the software by calling it simultaneously from a large
number of threads or processes, and look for evidence of any unexpected
behavior. The software's operation may slow down, but it should not
become unstable, crash, or generate incorrect results.
Testing
Identify error conditions that are not likely to occur during normal
usage and trigger them. For example, run the program under low memory
conditions, run with insufficient privileges or permissions, interrupt a
transaction before it is completed, or disable connectivity to basic
network services such as DNS. Monitor the software for any unexpected
behavior. If you trigger an unhandled exception or similar error that
was discovered and handled by the application's environment, it may
still indicate unexpected conditions that were not handled by the
application itself.
Weakness Ordinalities
Ordinality
Description
Primary
(where the
weakness exists independent of other weaknesses)
Resultant
(where the
weakness is typically related to the presence of some other
weaknesses)
Description
