CWE-665: Improper Initialization

Medium · CVSS 6.7

2020-12-08

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

Here, a boolean initiailized field is consulted to ensure that initialization tasks are only completed once. However, the field is mistakenly set to true during static initialization, so the initialization code is never reached.

Vulnerable example

java

private boolean initialized = true;

The following code intends to limit certain operations to the administrator only.

Vulnerable example

perl

# do stuff
$username = GetCurrentUser();

If the application is unable to extract the state information - say, due to a database timeout - then the $uid variable will not be explicitly set by the programmer. This will cause $uid to be regarded as equivalent to "0" in the conditional, allowing the original user to perform administrator actions. Even if the attacker cannot directly influence the state data, unexpected errors could cause incorrect privileges to be assigned to a user just by accident.

The following code intends to concatenate a string to a variable and print the string.

Vulnerable example

char str[20];

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2001-1471 — chain: an invalid value prevents a library file from being included, skipping initialization of key variables, leading to resultant eval injection.
CVE-2008-3637 — Improper error checking in protection mechanism produces an uninitialized variable, allowing security bypass and code execution.
CVE-2008-4197 — Use of uninitialized memory may allow code execution.
CVE-2008-2934 — Free of an uninitialized pointer leads to crash and possible code execution.
CVE-2007-3749 — OS kernel does not reset a port when starting a setuid program, allowing local users to access the port and gain privileges.
CVE-2008-0063 — Product does not clear memory contents when generating an error message, leading to information leak.
CVE-2008-0062 — Lack of initialization triggers NULL pointer dereference or double-free.
CVE-2008-0081 — Uninitialized variable leads to code execution in popular desktop application.
CVE-2008-3688 — chain: Uninitialized variable leads to infinite loop.
CVE-2008-3475 — chain: Improper initialization leads to memory corruption.
CVE-2008-5021 — Composite: race condition allows attacker to modify an object while it is still being initialized, causing software to access uninitialized memory.
CVE-2005-1036 — Chain: Bypass of access restrictions due to improper authorization (CWE-862) of a user results from an improperly initialized (CWE-909) I/O permission bitmap
CVE-2008-3597 — chain: game server can access player data structures before initialization has happened leading to NULL dereference
CVE-2009-2692 — Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476)
CVE-2009-0949 — chain: improper initialization of memory can lead to NULL dereference
CVE-2009-3620 — chain: some unprivileged ioctls do not verify that a structure has been initialized before invocation, leading to NULL dereference

CWE-665: Improper Initialization

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Dynamic Analysis

Manual Dynamic Analysis

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

What is CWE-665?

What CVEs are caused by CWE-665?

How do you prevent CWE-665?

How is CWE-665 detected?

What are the consequences of CWE-665?

Is CWE-665 actively exploited?

References

Stay ahead of CWE-665

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Dynamic Analysis

Manual Dynamic Analysis

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

What is CWE-665?

What CVEs are caused by CWE-665?

How do you prevent CWE-665?

How is CWE-665 detected?

What are the consequences of CWE-665?

Is CWE-665 actively exploited?

References

Stay ahead of CWE-665