cve.bz

CWE-908: Use of Uninitialized Resource, page 10

Filter

The product uses or accesses a resource that has not been initialized.

What the weakness is: CWE-908 at MITRE

Ask an AI about CWE-908

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-908: Use of Uninitialized Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/908.html and https://cve.bz/cve/cwe/908?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2018-9421EPSS 0.08%

    In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction…

  2. 5.5CVE-2018-9420EPSS 0.08%

    In BnCameraService::onTransact of CameraService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is …

  3. 5.5CVE-2018-9346EPSS 0.08%

    In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User inter…

  4. 5.5CVE-2018-9345EPSS 0.08%

    In BnAudioPolicyService::onTransact of AudioPolicyService.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User inter…

  5. 5.5CVE-2024-53083EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: qcom-pmic: init value of hdr_len/txbuf_len earlier If the read of USB_PDPHY_RX_ACKNOWLEDGE_REG failed, then hdr_len and txbuf_len are uninitialized. This com…

  6. 5.5CVE-2024-53066EPSS 0.7%

    In the Linux kernel, the following vulnerability has been resolved: nfs: Fix KMSAN warning in decode_getfattr_attrs() Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE Hardware name:…

  7. 5.5CVE-2024-50302KEVEPSS 0.8%

    In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make …

  8. 5.5CVE-2024-50300EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: regulator: rtq2208: Fix uninitialized use of regulator_config Fix rtq2208 driver uninitialized use to cause kernel error.

  9. 5.5CVE-2024-50299EPSS 0.6%

    In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix similar to that in Commit 50619dbf8db7 ("sctp: add size validation when walking chunks") is al…

  10. 5.5CVE-2024-50273EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF…

  11. 7.8CVE-2024-49029EPSS 0.8%

    Microsoft Excel Remote Code Execution Vulnerability

  12. 5.5CVE-2024-50241EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Initialize struct nfsd4_copy earlier Ensure the refcount and async_copies fields are initialized early. cleanup_async_copy() will reference these fields if an erro…

  13. 5.5CVE-2024-50237EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Avoid potentially crashing in the driver because of uninitialized private data

  14. 5.5CVE-2024-50173EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix access to uninitialized variable in tick_ctx_cleanup() The group variable can't be used to retrieve ptdev in our second loop, because it points to the p…

  15. 7.8CVE-2024-50143EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when computing alen in udf_current_aext to mitigate later uninit-value use in udf_get_fileshortad KMS…

  16. 5.5CVE-2024-50110EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: xfrm: fix one more kernel-infoleak in algo dumping During fuzz testing, the following issue was discovered: BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 _…

  17. 7.8CVE-2024-8896EPSS 0.2%

    A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A malicious actor can leverage this vulnerability to cause a crash, write sensitive data, or execute …

  18. 7.1CVE-2024-50035EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_async_encode() [1] In this case, pppoe_sendmsg() is called with a zero size. Then ppp_async_e…

  19. 7.1CVE-2024-50033EPSS 0.8%

    In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found that slhc_remember() was missing checks against malicious packets [1]. slhc_remember() onl…

  20. 5.5CVE-2022-48949EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: igb: Initialize mailbox message for VF reset When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is…

  21. 5.5CVE-2024-50014EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix access to uninitialised lock in fc replay path The following kernel trace can be triggered with fstest generic/629 when executed against a filesystem with fast…

  22. 5.5CVE-2024-49990EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/xe/hdcp: Check GSC structure validity Sometimes xe_gsc is not initialized when checked at HDCP capability check. Add gsc structure check to avoid null pointer error.

  23. 7.1CVE-2024-49900EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of new_ea in ea_buffer syzbot reports that lzo1x_1_do_compress is using uninit-value: =====================================================…

  24. 5.5CVE-2024-47687EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: Fix invalid mr resource destroy Certain error paths from mlx5_vdpa_dev_add() can end up releasing mr resources which never got initialized in the first place.…

  25. 9.1CVE-2024-47685EPSS 1.4%

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th-…

  26. 8.4CVE-2024-47966EPSS 0.2%

    Delta Electronics CNCSoft-G2 lacks proper initialization of memory prior to accessing it. An attacker can manipulate users to visit a malicious page or file to leverage this vulnerability to execute code in the context of the current proce…

  27. 6.5CVE-2024-43537EPSS 0.8%

    Windows Mobile Broadband Driver Denial of Service Vulnerability

  28. 7.1CVE-2024-43502EPSS 6.3%

    Windows Kernel Elevation of Privilege Vulnerability

  29. 7.1CVE-2024-46865EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: fou: fix initialization of grc The grc must be initialize first. There can be a condition where if fou is NULL, goto out will be executed and grc would be used uninitial…

  30. 4.3CVE-2024-7022EPSS 0.4%

    Uninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

  31. 5.5CVE-2024-46784EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup Currently napi_disable() gets called during rxq and txq cleanup, even before napi is enabled and hrti…

  32. 7.7CVE-2024-43458EPSS 1.8%

    Windows Networking Information Disclosure Vulnerability

  33. 8.8CVE-2024-38260EPSS 1.6%

    Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

  34. 7.5CVE-2024-38257EPSS 4.5%

    Microsoft AllJoyn API Information Disclosure Vulnerability

  35. 5.5CVE-2024-38256EPSS 0.7%

    Windows Kernel-Mode Driver Information Disclosure Vulnerability

  36. 6.2CVE-2024-38254EPSS 0.7%

    Windows Authentication Information Disclosure Vulnerability

  37. 9.8CVE-2024-8654EPSS 0.4%

    MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are called in internal aggregation stage. This issue affected MongoDB Server v6.0 version 6.0.3.

  38. 8.8CVE-2024-8178EPSS 0.6%

    The ctl_write_buffer and ctl_read_buffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code ex…

  39. 5.5CVE-2024-45005EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix validity interception issue when gisa is switched off We might run into a SIE validity if gisa has been disabled either via using kernel parameter "kvm.us…

  40. 7.1CVE-2024-44999EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtp_dev_xmit() syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->…

  41. 7.1CVE-2024-44983EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the protocol field of the VLAN header, validate it once before the flowtable lookup.…

  42. 3.9CVE-2024-45618EPSS 0.3%

    A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of…

  43. 3.9CVE-2024-45617EPSS 0.3%

    A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or …

  44. 3.9CVE-2024-45616EPSS 0.4%

    A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. The following pr…

  45. 3.9CVE-2024-45615EPSS 0.4%

    A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. The problem is missing initialization of variables expected to be initialized (as arguments to other functions, etc.).

  46. 3.3CVE-2024-43845EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: udf: Fix bogus checksum computation in udf_rename() Syzbot reports uninitialized memory access in udf_rename() when updating checksum of '..' directory entry of a moved …

  47. 7.1CVE-2024-43815EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - Ensure payload is zero when using key slot We could leak stack memory through the payload field when running AES with a key from one of the hardware's …

  48. 5.5CVE-2024-42312EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc…

  49. 5.5CVE-2024-42311EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0…

  50. 5.5CVE-2024-42283EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage.…