CWE-1419 Classe Incomplet

Incorrect Initialization of Resource

This weakness occurs when a system fails to properly set up a resource during its creation, leaving it in an unstable, incorrect, or insecure state when used later.

Définition

What is CWE-1419?

This weakness occurs when a system fails to properly set up a resource during its creation, leaving it in an unstable, incorrect, or insecure state when used later.
In software, this often happens due to reliance on implicit or default initialization. For instance, in C, stack memory isn't automatically cleared, and many scripting languages assign a default null or zero value to uninitialized variables. This can lead to critical security flaws if the resource controls access, like an authentication flag, or holds sensitive configuration data. In hardware, similar issues arise from incorrect reset values, misconfigured security fuses, or physical defects. Even if fuses are programmed correctly, broken lines or interfering hardware can corrupt the value. This incorrect initialization during boot or reset can compromise the entire device's security posture from the start.
Impact réel

Real-world CVEs caused by CWE-1419

  • CVE-2020-27211

    Chain: microcontroller system-on-chip uses a register value stored in flash to set product protection state on the memory bus and does not contain protection against fault injection (CWE-1319) which leads to an incorrect initialization of the memory bus (CWE-1419) causing the product to be in an unprotected state.

  • CVE-2023-25815

    chain: a change in an underlying package causes the gettext function to use implicit initialization with a hard-coded path (CWE-1419) under the user-writable C:\ drive, introducing an untrusted search path element (CWE-427) that enables spoofing of messages.

  • CVE-2022-43468

    WordPress module sets internal variables based on external inputs, allowing false reporting of the number of views

  • CVE-2022-36349

    insecure default variable initialization in BIOS firmware for a hardware board allows DoS

  • CVE-2015-7763

    distributed filesystem only initializes part of the variable-length padding for a packet, allowing attackers to read sensitive information from previously-sent packets in the same memory location

Comment les attaquants l'exploitent

Parcours de l'attaquant étape par étape

  1. 1

    Consider example design module system verilog code shown below. The register_example module is an example parameterized module that defines two parameters, REGISTER_WIDTH and REGISTER_DEFAULT. Register_example module defines a Secure_mode setting, which when set makes the register content read-only and not modifiable by software writes. register_top module instantiates two registers, Insecure_Device_ID_1 and Insecure_Device_ID_2. Generally, registers containing device identifier values are required to be read only to prevent any possibility of software modifying these values.

  2. 2

    These example instantiations show how, in a hardware design, it would be possible to instantiate the register module with insecure defaults and parameters.

  3. 3

    In the example design, both registers will be software writable since Secure_mode is defined as zero.

  4. 4

    This code attempts to login a user using credentials from a POST request:

  5. 5

    Because the $authorized variable is never initialized, PHP will automatically set $authorized to any value included in the POST request if register_globals is enabled. An attacker can send a POST request with an unexpected third value 'authorized' set to 'true' and gain authorized status without supplying valid credentials.

Exemple de code vulnérable

Vulnerable Verilog

Consider example design module system verilog code shown below. The register_example module is an example parameterized module that defines two parameters, REGISTER_WIDTH and REGISTER_DEFAULT. Register_example module defines a Secure_mode setting, which when set makes the register content read-only and not modifiable by software writes. register_top module instantiates two registers, Insecure_Device_ID_1 and Insecure_Device_ID_2. Generally, registers containing device identifier values are required to be read only to prevent any possibility of software modifying these values.

Vulnérable Verilog 
// Parameterized Register module example 
 // Secure_mode : REGISTER_DEFAULT[0] : When set to 1 register is read only and not writable// 
 module register_example 
 #( 
 parameter REGISTER_WIDTH = 8, // Parameter defines width of register, default 8 bits 
 parameter [REGISTER_WIDTH-1:0] REGISTER_DEFAULT = 2**REGISTER_WIDTH -2 // Default value of register computed from Width. Sets all bits to 1s except bit 0 (Secure _mode) 
 ) 
 ( 
 input [REGISTER_WIDTH-1:0] Data_in, 
 input Clk, 
 input resetn, 
 input write, 
 output reg [REGISTER_WIDTH-1:0] Data_out 
 ); 

 reg Secure_mode; 

 always @(posedge Clk or negedge resetn) 

```
   if (~resetn) 
   begin 
  	 Data_out <= REGISTER_DEFAULT; // Register content set to Default at reset 
  	 Secure_mode <= REGISTER_DEFAULT[0]; // Register Secure_mode set at reset 
   end 
   else if (write & ~Secure_mode) 
   begin 
  	 Data_out <= Data_in; 
   end 
 endmodule 
 module register_top 
 ( 
 input Clk, 
 input resetn, 
 input write, 
 input [31:0] Data_in, 
 output reg [31:0] Secure_reg, 
 output reg [31:0] Insecure_reg 
 ); 
 register_example #( 
   .REGISTER_WIDTH (32), 
   .REGISTER_DEFAULT (1224) // Incorrect Default value used bit 0 is 0. 
 ) Insecure_Device_ID_1 ( 
   .Data_in (Data_in), 
   .Data_out (Secure_reg), 
   .Clk (Clk), 
   .resetn (resetn), 
   .write (write) 
 ); 
 register_example #(
   .REGISTER_WIDTH (32) // Default not defined 2^32-2 value will be used as default. 
 ) Insecure_Device_ID_2 ( 
   .Data_in (Data_in), 
   .Data_out (Insecure_reg), 
   .Clk (Clk), 
   .resetn (resetn), 
   .write (write) 
 ); 
 endmodule
Exemple de code sécurisé

Secure Verilog

In the example design, both registers will be software writable since Secure_mode is defined as zero.

Sécurisé Verilog 
register_example #( 

```
   .REGISTER_WIDTH (32), 
   .REGISTER_DEFAULT (1225) // Correct default value set, to enable Secure_mode 
 ) Secure_Device_ID_example ( 
   .Data_in (Data_in), 
   .Data_out (Secure_reg), 
   .Clk (Clk), 
   .resetn (resetn), 
   .write (write) 
 );
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Liste de contrôle de prévention

How to prevent CWE-1419

  • Implementation Choose the safest-possible initialization for security-related resources.
  • Implementation Ensure that each resource (whether variable, memory buffer, register, etc.) is fully initialized.
  • Implementation Pay close attention to complex conditionals or reset sources that affect initialization, since some paths might not perform the initialization.
  • Architecture and Design Ensure that the design and architecture clearly identify what the initialization should be, and that the initialization does not have security implications.
Signaux de détection

How to detect CWE-1419

SAST High

Exécuter une analyse statique (SAST) sur le code source à la recherche du motif non sécurisé dans le flux de données.

DAST Moderate

Exécuter des tests de sécurité applicative dynamique (DAST) contre le point de terminaison en ligne.

Runtime Moderate

Surveiller les journaux runtime pour détecter des traces d'exception inhabituelles, des entrées malformées ou des tentatives de contournement d'autorisation.

Code review Moderate

Revue de code : signaler tout nouveau code qui traite les entrées de cette surface sans utiliser les helpers du framework validés.

Correction automatique Plexicus

Plexicus détecte automatiquement CWE-1419 et ouvre une PR de correction en moins de 60 secondes.

Codex Remedium analyse chaque commit, identifie cette faiblesse précise et livre une pull request prête à être relue avec le correctif. Pas de tickets. Pas de transferts.

Obtenir une démo Essayer Plexicus gratuitement
Questions fréquentes

Frequently asked questions

Qu'est-ce que CWE-1419 ?

This weakness occurs when a system fails to properly set up a resource during its creation, leaving it in an unstable, incorrect, or insecure state when used later.

Quelle est la gravité de CWE-1419 ?

MITRE n'a pas publié de note de probabilité d'exploitation pour cette faiblesse. Traitez-la comme un impact moyen jusqu'à ce que votre modèle de menace prouve le contraire.

Quels langages ou plateformes sont affectés par CWE-1419 ?

MITRE lists the following affected platforms: Not OS-Specific, Not Architecture-Specific, Not Technology-Specific.

Comment puis-je prévenir CWE-1419 ?

Choose the safest-possible initialization for security-related resources. Ensure that each resource (whether variable, memory buffer, register, etc.) is fully initialized.

Comment Plexicus détecte et corrige CWE-1419 ?

Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-1419 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.

Où puis-je en savoir plus sur CWE-1419 ?

MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/1419.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.

Faiblesses associées

Weaknesses related to CWE-1419

CWE-665 Parent

Improper Initialization

This vulnerability occurs when software fails to properly set up a resource before use, or provides incorrect starting values, leaving it…

CWE-1188 Frère

Initialization of a Resource with an Insecure Default

This vulnerability occurs when software uses an insecure default setting or value for a resource, assuming an administrator will change it…

CWE-1279 Frère

Cryptographic Operations are run Before Supporting Units are Ready

This vulnerability occurs when cryptographic processes start before their required dependencies are properly initialized and ready to…

CWE-1434 Frère

Insecure Setting of Generative AI/ML Model Inference Parameters

This vulnerability occurs when a generative AI or ML model is deployed with inference parameters that are too permissive, causing it to…

CWE-455 Frère

Non-exit on Failed Initialization

This vulnerability occurs when software continues to run as normal after encountering a critical security failure during its startup…

CWE-456 Frère

Missing Initialization of a Variable

This vulnerability occurs when a program uses a variable before giving it a starting value, causing the software to rely on unpredictable…

CWE-457 Frère

Use of Uninitialized Variable

This vulnerability occurs when a program accesses a variable before it has been assigned a value, leading to unpredictable behavior and…

CWE-770 Frère

Allocation of Resources Without Limits or Throttling

This vulnerability occurs when a system allows users or processes to request resources without any built-in caps or rate limits. Think of…

CWE-908 Frère

Use of Uninitialized Resource

This vulnerability occurs when software attempts to use a resource—like memory, a file handle, or an object—before it has been properly…

Ressources

Further reading

Prêt quand vous l'êtes

Arrêtez de payer par développeur.
Commencez à fermer la boucle.

Plexicus est l'ASPM natif IA qui scanne, filtre, corrige, penteste et explique — de façon autonome. Développeurs illimités, dépôts illimités, actions IA à usage équitable. Vrai niveau gratuit, €269/mo annuel quand vous êtes prêt.

Commencer gratuitement Réserver une démo