CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.1)  
Search by ID:

CWE-665: Incorrect or Incomplete Initialization

Individual Definition in a New Window
Incorrect or Incomplete Initialization
Status: Draft
Weakness ID: 665 (Weakness Base)
Description
Summary

The software does not follow the proper procedures for initializing a resource and might leave the resource in an improper state for future uses.

Potential Mitigations

Perform adequate initialization.

Demonstrative Examples

Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached.

Java Example:
private boolean initialized = true;
public void someMethod() {
if (!initialized) {
// perform initialization tasks
...
 
initialized = true;
}
Observed Examples
ReferenceDescription
An invalid value prevents a library file from being included, skipping initialization of key variables, leading to resultant eval injection.
Permission bitmap is not properly initialized, leading to resultant privilege elevation or DoS.
Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness ClassWeakness ClassWeakness Class664Insufficient Control of a Resource Through its Lifetime
Research Concepts (primary)1000
ChildOfCategoryCategory452Initialization and Cleanup Errors
Development Concepts (primary)699
ChildOfCategoryCategory740CERT C Secure Coding Section 06 - Arrays (ARR)
Weaknesses Addressed by the CERT C Secure Coding Standard (primary)734
ChildOfCategoryCategory742CERT C Secure Coding Section 08 - Memory Management (MEM)
Weaknesses Addressed by the CERT C Secure Coding Standard734
ParentOfWeakness BaseWeakness BaseWeakness Base453Insecure Default Variable Initialization
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base454External Initialization of Trusted Variables
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base455Non-exit on Failed Initialization
Research Concepts1000
ParentOfWeakness BaseWeakness BaseWeakness Base456Missing Initialization
Research Concepts (primary)1000
Taxonomy Mappings
Mapped Taxonomy NameNode IDMapped Node Name
PLOVER Incorrect initialization
CERT C Secure CodingARR02-CExplicitly specify array bounds, even if implicitly defined by an initializer
CERT C Secure CodingMEM09-CDo not assume memory allocation routines initialize memory
Applicable Platforms
Languages
All
Time of Introduction
* Implementation
* Operation
Content History
Submissions
PLOVER. (Externally Mined)
Modifications
Sean Eidemiller. Cigital. 2008-07-01. (External)
added/updated demonstrative examples
Eric Dalci. Cigital. 2008-07-01. (External)
updated Potential_Mitigations, Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Relationships, Taxonomy_Mappings
CWE Content Team. MITRE. 2008-11-24. (Internal)
updated Relationships, Taxonomy_Mappings
Back to top
Page Last Updated: November 24, 2008
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us