Weakness (CWE)
CWE-908: Use of Uninitialized Resource
The product uses or accesses a resource that has not been initialized.
How to prevent it (4 mitigations)
-
Implementation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
-
Implementation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
-
Implementation
Avoid race conditions (CWE-362) during initialization routines.
-
Build and Compilation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
Source: MITRE CWE-908
560 results · Feed
-
Medium 5.5
Event Tracing for Windows Information Disclosure Vulnerability
Event Tracing for Windows Information Disclosure Vulnerability
-
High 8.8
A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further…
-
Medium 4.6
ewxrjk sftpserver parse.c sftp_parse_path uninitialized pointer
A vulnerability was found in ewxrjk sftpserver. It has been declared as problematic. Affected by this vulnerability is the function sftp_parse_path of the file parse.c. The manipulation leads to uninitialized pointer. The real existence of this vulnerability …
-
High 7.8
Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability …
-
High 7.8
Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability …
-
Medium 6.7
In isp, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privi…
-
Medium 6.7
In ccd, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privi…
-
Low 3.5
RDP client: Read of uninitialized memory with parallel port redirection
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server imple…
-
High 8.1
Uninitialized memory read in LZ4 decompression leads to authentication bypass in Scylla
Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scylla assumes that user-provided uncompressed length is correct. If user provides fake length, that is …
-
Unscored —
A segmentation fault was discovered in radare2 with adf command. In libr/core/cmd_anal.c, when command "adf" has no or …
-
Medium 4.0
L2CAP: Information leakage in le_ecred_conn_req()
Information leakage in le_ecred_conn_req(). Zephyr versions >= v2.4.0 Use of Uninitialized Resource (CWE-908). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-xhg3-gvj6-4rqh
-
High 7.5
Denial of Service (DoS)
All versions of package @discordjs/opus are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash.
-
Medium 5.9
Use of Uninitialized Variable in trilogy
Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to read and return up to 12 bytes of data from an uninitialized variable in stack memory. Users of the tr…
-
Medium 5.5
Segfault due to missing support for quantized types in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of service in TensorFlow by calling `tf.compat.v1.*` ops which don't yet have support for quantized types,…
-
Medium 5.9
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5, and 14.1.x versions prior to 14.1.4.6,…
-
Unscored —
In Eclipse Openj9 before version 0.32.0, Java 8 & 11 fail to throw the exception captured during bytecode verification …
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_ne…
-
High 7.6
Uninitialized variable access in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignm…
-
High 7.4CVE-2021-43848 Public exploit
Unititialized memory access in h2o
h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HT…
-
High 7.5
Missing Initialization of Resource in pnet
An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
-
High 7.5
`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)
An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
-
Critical 9.8
InputStream::read_exact : `Read` on uninitialized buffer causes UB
An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in acc_reader.
An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
-
Critical 9.8
`Read` on uninitialized buffer can cause UB (impl of `ReadKVExt`)
An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.
-
Critical 9.8
'Read' on uninitialized memory may cause UB
An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in flumedb.
An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.
-
Critical 9.8
columnar: Read on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())
An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in ash.
An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
-
Critical 9.8
Reading on uninitialized buffer may cause UB ( `gfx_auxil::read_spirv()` )
An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in messagepack-rs.
An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
-
High 7.5
Window may read from uninitialized memory locations in rdiff
An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in tectonic_xdv
An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.
-
Critical 9.8
Use of Uninitialized Resource in csv-sniffer.
An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.
-
High 7.5
Use of Uninitialized Resource in smallvec
An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.
-
Medium 5.5
A use of uninitialized value vulnerability in Tensorflow
TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` no…
-
Medium 6.5
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
Medium 4.0
An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. Th…
-
Medium 4.4
Use of unitialized value in TensorFlow Lite
TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a…
-
Critical 9.8
Use of Uninitialized Resource in alg_ds
An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new().
-
Critical 9.8
Use of Uninitialized Resource in libp2p-deflate
An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.