CWE-908
AllowedUse of Uninitialized Resource
Abstraction: Base · Status: Incomplete
The product uses or accesses a resource that has not been initialized.
961 vulnerabilities reference this CWE, most recent first.
GHSA-HFH2-MJPV-G64V
Vulnerability from github – Published: 2023-07-13 00:30 – Updated: 2024-04-04 06:05The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user space. The contents of this memory could contain sensitive information.
{
"affected": [],
"aliases": [
"CVE-2021-0948"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-13T00:15:23Z",
"severity": "MODERATE"
},
"details": "The PVRSRVBridgeGetMultiCoreInfo ioctl in the PowerVR kernel driver can return uninitialized kernel memory to user space. The contents of this memory could contain sensitive information.\n\n",
"id": "GHSA-hfh2-mjpv-g64v",
"modified": "2024-04-04T06:05:06Z",
"published": "2023-07-13T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0948"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-07-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HFWG-2MM4-H8C4
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-11-07 18:31In the Linux kernel, the following vulnerability has been resolved:
media: mxl111sf: change mutex_init() location
Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location.
Previous mutex_init(&state->msg_lock) call was in ->init() function, but dvb_usbv2_init() has this order of calls:
dvb_usbv2_init()
dvb_usbv2_adapter_init()
dvb_usbv2_adapter_frontend_init()
props->frontend_attach()
props->init()
Since mxl111sf_ devices call mxl111sf_ctrl_msg() in ->frontend_attach() internally we need to initialize state->msg_lock before frontend_attach(). To achieve it, ->probe() call added to all mxl111sf_ devices, which will simply initiaize mutex.
{
"affected": [],
"aliases": [
"CVE-2021-47583"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T15:15:52Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: mxl111sf: change mutex_init() location\n\nSyzbot reported, that mxl111sf_ctrl_msg() uses uninitialized\nmutex. The problem was in wrong mutex_init() location.\n\nPrevious mutex_init(\u0026state-\u003emsg_lock) call was in -\u003einit() function, but\ndvb_usbv2_init() has this order of calls:\n\n\tdvb_usbv2_init()\n\t dvb_usbv2_adapter_init()\n\t dvb_usbv2_adapter_frontend_init()\n\t props-\u003efrontend_attach()\n\n\t props-\u003einit()\n\nSince mxl111sf_* devices call mxl111sf_ctrl_msg() in -\u003efrontend_attach()\ninternally we need to initialize state-\u003emsg_lock before\nfrontend_attach(). To achieve it, -\u003eprobe() call added to all mxl111sf_*\ndevices, which will simply initiaize mutex.",
"id": "GHSA-hfwg-2mm4-h8c4",
"modified": "2024-11-07T18:31:21Z",
"published": "2024-06-19T15:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-47583"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/44870a9e7a3c24acbb3f888b2a7cc22c9bdf7e7f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4b2d9600b31f9ba7adbc9f3c54a068615d27b390"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8c6fdf62bfe1bc72bfceeaf832ef7499c7ed09ba"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/96f182c9f48b984447741f054ec301fdc8517035"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b99bdf127af91d53919e96292c05f737c45ea59a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HG2X-2C94-6W8P
Vulnerability from github – Published: 2024-06-14 09:31 – Updated: 2024-06-14 09:31Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.
{
"affected": [],
"aliases": [
"CVE-2024-36503"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-14T08:15:41Z",
"severity": "HIGH"
},
"details": "Memory management vulnerability in the Gralloc module\nImpact: Successful exploitation of this vulnerability will affect availability.",
"id": "GHSA-hg2x-2c94-6w8p",
"modified": "2024-06-14T09:31:17Z",
"published": "2024-06-14T09:31:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36503"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2024/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HJ95-CVVQ-RC83
Vulnerability from github – Published: 2022-05-02 00:00 – Updated: 2025-04-09 03:59Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka "Uninitialized Memory Corruption Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2008-3475"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-10-15T00:12:00Z",
"severity": "HIGH"
},
"details": "Microsoft Internet Explorer 6 does not properly handle errors related to using the componentFromPoint method on xml objects that have been (1) incorrectly initialized or (2) deleted, which allows remote attackers to execute arbitrary code via a crafted HTML document, aka \"Uninitialized Memory Corruption Vulnerability.\"",
"id": "GHSA-hj95-cvvq-rc83",
"modified": "2025-04-09T03:59:29Z",
"published": "2022-05-02T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3475"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45563"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45565"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13151"
},
{
"type": "WEB",
"url": "http://ifsec.blogspot.com/2008/10/internet-explorer-6-componentfrompoint.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=122479227205998\u0026w=2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/497380/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31617"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1021047"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA08-288A.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2809"
},
{
"type": "WEB",
"url": "http://www.zerodayinitiative.com/advisories/ZDI-08-069"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HM6P-6MQ5-564C
Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka "DOM Manipulation Memory Corruption Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2011-1251"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-06-16T20:55:00Z",
"severity": "HIGH"
},
"details": "Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, aka \"DOM Manipulation Memory Corruption Vulnerability.\"",
"id": "GHSA-hm6p-6mq5-564c",
"modified": "2022-05-13T01:03:29Z",
"published": "2022-05-13T01:03:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1251"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-050"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12326"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HMMC-GG67-83CW
Vulnerability from github – Published: 2024-06-19 15:30 – Updated: 2024-11-06 21:30In the Linux kernel, the following vulnerability has been resolved:
net: micrel: Fix receiving the timestamp in the frame for lan8841
The blamed commit started to use the ptp workqueue to get the second part of the timestamp. And when the port was set down, then this workqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING is not enabled, then the ptp_clock is not initialized so then it would crash when it would try to access the delayed work. So then basically by setting up and then down the port, it would crash. The fix consists in checking if the ptp_clock is initialized and only then cancel the delayed work.
{
"affected": [],
"aliases": [
"CVE-2024-38593"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-19T14:15:19Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: micrel: Fix receiving the timestamp in the frame for lan8841\n\nThe blamed commit started to use the ptp workqueue to get the second\npart of the timestamp. And when the port was set down, then this\nworkqueue is stopped. But if the config option NETWORK_PHY_TIMESTAMPING\nis not enabled, then the ptp_clock is not initialized so then it would\ncrash when it would try to access the delayed work.\nSo then basically by setting up and then down the port, it would crash.\nThe fix consists in checking if the ptp_clock is initialized and only\nthen cancel the delayed work.",
"id": "GHSA-hmmc-gg67-83cw",
"modified": "2024-11-06T21:30:54Z",
"published": "2024-06-19T15:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38593"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3ddf170e4a604f5d4d9459a36993f5e92b53e8b0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3fd4282d5f25c3c97fef3ef0b89b82ef4e2bc975"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/64a47cf634ae44e92be24ebc982410841093bd7b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aea27a92a41dae14843f92c79e9e42d8f570105c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HP8F-3HGQ-8P42
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2022-10-11 19:00Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.
{
"affected": [],
"aliases": [
"CVE-2019-5818"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-27T17:15:00Z",
"severity": "MODERATE"
},
"details": "Uninitialized data in media in Google Chrome prior to 74.0.3729.108 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file.",
"id": "GHSA-hp8f-3hgq-8p42",
"modified": "2022-10-11T19:00:34Z",
"published": "2022-05-24T16:48:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5818"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_23.html"
},
{
"type": "WEB",
"url": "https://crbug.com/929962"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CPM7VPE27DUNJLXM4F5PAAEFFWOEND6X"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FKN4GPMBQ3SDXWB4HL45II5CZ7P2E4AI"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Aug/19"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201908-18"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4500"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00085.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HPC3-58QP-H295
Vulnerability from github – Published: 2023-02-18 00:31 – Updated: 2023-02-28 21:30HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of qnotify at pci_vtrnd_notify fails to check the return value of vq_getchain. This leads to struct iovec iov; being uninitialized and used to read memory in len = (int) read(sc->vrsc_fd, iov.iov_base, iov.iov_len); when an attacker is able to make vq_getchain fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.
{
"affected": [],
"aliases": [
"CVE-2021-32845"
],
"database_specific": {
"cwe_ids": [
"CWE-252",
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-17T23:15:00Z",
"severity": "HIGH"
},
"details": "HyperKit is a toolkit for embedding hypervisor capabilities in an application. In versions 0.20210107 and prior of HyperKit, the implementation of `qnotify` at `pci_vtrnd_notify` fails to check the return value of `vq_getchain`. This leads to `struct iovec iov;` being uninitialized and used to read memory in `len = (int) read(sc-\u003evrsc_fd, iov.iov_base, iov.iov_len);` when an attacker is able to make `vq_getchain` fail. This issue may lead to a guest crashing the host causing a denial of service and, under certain circumstance, memory corruption. This issue is fixed in commit 41272a980197917df8e58ff90642d14dec8fe948.",
"id": "GHSA-hpc3-58qp-h295",
"modified": "2023-02-28T21:30:17Z",
"published": "2023-02-18T00:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32845"
},
{
"type": "WEB",
"url": "https://github.com/moby/hyperkit/pull/313"
},
{
"type": "WEB",
"url": "https://github.com/moby/hyperkit/commit/41272a980197917df8e58ff90642d14dec8fe948"
},
{
"type": "ADVISORY",
"url": "https://securitylab.github.com/advisories/GHSL-2021-054_057-moby-hyperkit"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HPCX-3PW8-G3J2
Vulnerability from github – Published: 2021-08-25 20:54 – Updated: 2022-06-14 20:23An issue was discovered in the telemetry crate through 0.1.2 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size()
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "telemetry"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-29937"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-19T17:09:26Z",
"nvd_published_at": "2021-04-01T05:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in the telemetry crate through 0.1.2 for Rust. There is a drop of uninitialized memory if a value.clone() call panics within misc::vec_with_size()",
"id": "GHSA-hpcx-3pw8-g3j2",
"modified": "2022-06-14T20:23:55Z",
"published": "2021-08-25T20:54:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29937"
},
{
"type": "WEB",
"url": "https://github.com/Yoric/telemetry.rs/issues/45"
},
{
"type": "WEB",
"url": "https://github.com/Yoric/telemetry.rs/commit/2820cf12f2e08645fd6d1f15b4a90a54d6082a81"
},
{
"type": "PACKAGE",
"url": "https://github.com/Yoric/telemetry.rs"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2021-0046.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Free of uninitialized memory in telemetry"
}
GHSA-HQ7P-G8P2-W5C2
Vulnerability from github – Published: 2024-06-13 21:30 – Updated: 2024-07-11 15:30In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2024-29780"
],
"database_specific": {
"cwe_ids": [
"CWE-908"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-13T21:15:51Z",
"severity": "MODERATE"
},
"details": "In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.",
"id": "GHSA-hq7p-g8p2-w5c2",
"modified": "2024-07-11T15:30:42Z",
"published": "2024-06-13T21:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29780"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2024-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all required steps.
Mitigation
Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
Mitigation
Avoid race conditions (CWE-362) during initialization routines.
Mitigation
Run or compile the product with settings that generate warnings about uninitialized variables or data.
No CAPEC attack patterns related to this CWE.