CWE-665
Improper Initialization
AI Translation Available
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Status
draft
Abstraction
class
Likelihood
medium
Affected Platforms
Extended Description
AI Translation
This can have security implications when the associated resource is expected to have certain properties or values, such as a variable that determines whether a user has been authenticated or not.
Technical Details
AI Translation
Common Consequences
confidentiality
access control
availability
Impacts
read memory
read application data
bypass protection mechanism
dos: crash, exit, or restart
Detection Methods
automated dynamic analysis
manual dynamic analysis
automated static analysis
Potential Mitigations
Phases:
requirements
architecture and design
implementation
build and compilation
testing
Descriptions:
•
Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, in Java, if the programmer does not explicitly initialize a variable, then the code could produce a compile-time error (if the variable is local) or automatically initialize the variable to the default value for the variable's type. In Perl, if explicit initialization is not performed, then a default value of undef is assigned, which is interpreted as 0, false, or an equivalent value depending on the context in which the variable is accessed.
•
Explicitly initialize all your variables and other data stores, either during declaration or just before the first usage.
•
Avoid race conditions (CWE-362) during initialization routines.
•
Use automated static analysis tools that target this type of weakness. Many modern techniques use data flow analysis to minimize the number of false positives. This is not a perfect solution, since 100% accuracy and coverage are not feasible.
•
Identify all variables and data stores that receive information from external sources, and apply input validation to make sure that they are only initialized to expected values.
•
Pay close attention to complex conditionals that affect initialization, since some conditions might not perform the initialization.
•
Run or compile your product with settings that generate warnings about uninitialized variables or data.