CWE-457: Use of Uninitialized Variable

Description

The code uses a variable that has not been initialized, leading to unpredictable or unintended results.

Potential Impact

Availability: Other
Authorization: Other

How to Fix

Implementation

Ensure that critical variables are initialized before first use [REF-1485].

Build and Compilation

Most compilers will complain about the use of uninitialized variables if warnings are turned on.

Implementation

When using a language that does not require explicit declaration of variables, run or compile the software in a mode that reports undeclared or unknown variables. This may indicate the presence of a typographic error in the variable's name.

Requirements

Choose a language that is not susceptible to these issues.

Architecture and Design

Mitigating technologies such as safe string libraries and container abstractions could be introduced.

Detection Methods

Fuzzing: Fuzz testing (fuzzing) is a powerful technique for generating large numbers of diverse inputs - either randomly or algorithmically - and dynamically invoking the code with those inputs. Even with rand...
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin...

Related Weaknesses

References

View on MITRE CWE Database →

Use of Uninitialized Variable