CWE-456 Variant Draft

Missing Initialization of a Variable

This vulnerability occurs when a program uses a variable before giving it a starting value, causing the software to rely on unpredictable data left over in memory.

Definition

What is CWE-456?

This vulnerability occurs when a program uses a variable before giving it a starting value, causing the software to rely on unpredictable data left over in memory.
Missing initialization is a common coding mistake that can lead to crashes, incorrect calculations, or security bypasses. The risk is highest when the uninitialized variable controls security logic, like an authentication flag, or influences critical operations. Developers should proactively initialize all variables upon declaration, especially those used in security checks or before any conditional assignment. While SAST tools can detect this pattern, managing it across a large, evolving codebase is challenging. An ASPM platform like Plexicus uses AI to not only identify these flaws but also to suggest the precise code fix, automating remediation and saving significant manual review time.
Auswirkungen in der Praxis

Real-world CVEs caused by CWE-456

  • CVE-2020-6078

    Chain: The return value of a function returning a pointer is not checked for success (CWE-252) resulting in the later use of an uninitialized variable (CWE-456) and a null pointer dereference (CWE-476)

  • CVE-2019-3836

    Chain: secure communications library does not initialize a local variable for a data structure (CWE-456), leading to access of an uninitialized pointer (CWE-824).

  • CVE-2018-14641

    Chain: C union member is not initialized (CWE-456), leading to access of invalid pointer (CWE-824)

  • CVE-2009-2692

    Chain: Use of an unimplemented network socket operation pointing to an uninitialized handler function (CWE-456) causes a crash because of a null pointer dereference (CWE-476).

  • CVE-2020-20739

    A variable that has its value set in a conditional statement is sometimes used when the conditional fails, sometimes causing data leakage

  • CVE-2005-2978

    Product uses uninitialized variables for size and index, leading to resultant buffer overflow.

  • CVE-2005-2109

    Internal variable in PHP application is not initialized, allowing external modification.

  • CVE-2005-2193

    Array variable not initialized in PHP application, leading to resultant SQL injection.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

  1. 1

    This function attempts to extract a pair of numbers from a user-supplied string.

  2. 2

    This code attempts to extract two integer values out of a formatted, user-supplied input. However, if an attacker were to provide an input of the form:

  3. 3

    then only the m variable will be initialized. Subsequent use of n may result in the use of an uninitialized variable (CWE-457).

  4. 4

    Here, an uninitialized field in a Java class is used in a seldom-called method, which would cause a NullPointerException to be thrown.

  5. 5

    This code first authenticates a user, then allows a delete command if the user is an administrator.

Verwundbares Codebeispiel

Vulnerable C

This function attempts to extract a pair of numbers from a user-supplied string.

Verwundbar C 
void parse_data(char *untrusted_input){
  		int m, n, error;
  		error = sscanf(untrusted_input, "%d:%d", &m, &n);
  		if ( EOF == error ){
  			die("Did not specify integer value. Die evil hacker!\n");
  		}
```
/* proceed assuming n and m are initialized correctly */* 
  		}
Angreifer-Payload

This code attempts to extract two integer values out of a formatted, user-supplied input. However, if an attacker were to provide an input of the form:

Angreifer-Payload 
123:
Sicheres Codebeispiel

Secure Java

However, if the method setUser is not called before authenticateUser then the user variable will not have been initialized and will result in a NullPointerException. The code should verify that the user variable has been initialized before it is used, as in the following code.

Sicher Java 
public class BankManager {
```
// user allowed to perform bank manager tasks* 
  		private User user = null;
  		private boolean isUserAuthentic = false;
  		
  		
  		 *// constructor for BankManager class* 
  		public BankManager(String username) {
  		```
  			user = getUserFromUserDatabase(username);
  		}
```
// retrieve user from database of users* 
  		public User getUserFromUserDatabase(String username) {...}
  		
  		
  		 *// authenticate user* 
  		public boolean authenticateUser(String username, String password) {
  		```
  				if (user == null) {
  					System.out.println("Cannot find user " + username);
  				}
  				else {
  					if (password.equals(user.getPassword())) {
  						isUserAuthentic = true;
  					}
  				}
  				return isUserAuthentic;
  		}
```
// methods for performing bank manager tasks* 
  				...
  		}
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste

How to prevent CWE-456

  • Implementation Ensure that critical variables are initialized before first use [REF-1485].
  • Requirements Choose a language that is not susceptible to these issues.
Erkennungssignale

How to detect CWE-456

Automated Static Analysis High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Plexicus Auto-Fix

Plexicus erkennt CWE-456 automatisch und öffnet in unter 60 Sekunden einen Fix-PR.

Codex Remedium scannt jeden Commit, identifiziert genau diese Schwachstelle und liefert einen reviewer-ready Pull Request mit dem Patch. Keine Tickets. Keine Hand-offs.

Demo anfordern Plexicus kostenlos testen
Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-456?

This vulnerability occurs when a program uses a variable before giving it a starting value, causing the software to rely on unpredictable data left over in memory.

Wie gravierend ist CWE-456?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-456 betroffen?

MITRE hat für diese CWE keine betroffenen Plattformen spezifiziert — sie kann in den meisten Anwendungs-Stacks auftreten.

Wie kann ich CWE-456 verhindern?

Ensure that critical variables are initialized before first use [REF-1485]. Choose a language that is not susceptible to these issues.

Wie erkennt und behebt Plexicus CWE-456?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-456 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-456?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/456.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Verwandte Schwachstellen

Weaknesses related to CWE-456

CWE-909 Parent

Missing Initialization of Resource

The software fails to properly set up a critical resource before using it.

CWE-1271 Sibling

Uninitialized Value on Reset for Registers Holding Security Settings

Security-critical hardware registers start with random, unpredictable values when a device powers on or resets, creating an immediate…

CWE-89 Kann vorausgehen

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SQL Injection occurs when an application builds a database query using untrusted user input without properly sanitizing it. This allows an…

CWE-120 Kann vorausgehen

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

This vulnerability occurs when a program copies data from one memory location to another without first verifying that the source data will…

CWE-98 Kann vorausgehen

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

This vulnerability occurs when a PHP application uses unvalidated or insufficiently restricted user input directly within file inclusion…

CWE-457 Kann vorausgehen

Use of Uninitialized Variable

This vulnerability occurs when a program accesses a variable before it has been assigned a value, leading to unpredictable behavior and…

Ressourcen

Further reading

Bereit, wenn du es bist

Schluss mit dem Bezahlen pro Entwickler.
Schließ den Kreislauf.

Plexicus ist die KI-native ASPM, die scannt, filtert, fixt, pentestet und erklärt — autonom. Unbegrenzte Entwickler, unbegrenzte Repos, Fair-Use-KI-Aktionen. Echter kostenloser Tarif, €269/mo jährlich, wenn du bereit bist.

Kostenlos starten Demo buchen