CWE-908 — Use of Uninitialized Resource
CWE-908: Use of Uninitialized Resource
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Incomplete |
| Likelihood of exploit | Medium |
Description
The product uses or accesses a resource that has not been initialized.
When a resource has not been properly initialized, the product may behave unexpectedly. This may lead to a crash or invalid memory access, but the consequences vary depending on the type of resource and how it is used within the product.
Common consequences
- Confidentiality: Read Memory, Read Application Data
- Availability: DoS: Crash, Exit, or Restart
Mitigations
Implementation — Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Implementation — Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Implementation — Avoid race conditions (CWE-362) during initialization routines.
Build and Compilation — Run or compile the product with settings that generate warnings about uninitialized variables or data.
References
- CWE page: https://cwe.mitre.org/data/definitions/908.html
- CWE list: https://cwe.mitre.org/data/index.html