CWE-457: Use of Uninitialized Variable

Description

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

In some languages such as C and C++, stack variables are not initialized by default. They generally contain junk data with the contents of stack memory before the function was invoked. An attacker can sometimes control or read these contents. In other languages or conditions, a variable that is not explicitly initialized can be given a default value that has security implications, depending on the logic of the program. The presence of an uninitialized variable can sometimes indicate a typographic error in the code.

Potential Impact

Demonstrative Examples

if (isset($_POST['names'])) {$nameArray = $_POST['names'];}echo "Hello " . $nameArray['first'];

int aN, Bn;switch (ctl) {
                        case -1:aN = 0;bN = 0;break;
                           case 0:aN = i;bN = -i;break;
                           case 1:aN = i + NEXT_SZ;bN = i - NEXT_SZ;break;
                           default:aN = -1;aN = -1;break;
                        
                     }repaint(aN, bN);

char *test_string;
                if (i != err_val)
                {
                test_string = "Hello World!";
                }
                printf("%s", test_string);

char *test_string = "Done at the beginning";
				if (i != err_val)
				{
				test_string = "Hello World!";
				}
				printf("%s", test_string);

char *test_string;
				if (i != err_val)
				{
				test_string = "Hello World!";
				}
				else {
				test_string = "Done on the other side!";
				}
				printf("%s", test_string);

Mitigations & Prevention

Detection Methods

• Fuzzing High — Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with random inputs, it is often capable of generating unexpected results such as crashes, memory corruption,
• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Related Weaknesses

Taxonomy Mappings

• CLASP: — Uninitialized variable
• 7 Pernicious Kingdoms: — Uninitialized Variable
• Software Fault Patterns: SFP1 — Glitch in computation
• SEI CERT Perl Coding Standard: DCL33-PL — Declare identifiers before using them