cve.bz

CWE-908: Use of Uninitialized Resource, page 11

Filter

The product uses or accesses a resource that has not been initialized.

What the weakness is: CWE-908 at MITRE

Ask an AI about CWE-908

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-908: Use of Uninitialized Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/908.html and https://cve.bz/cve/cwe/908?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2024-42272EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointe…

  2. 2.1CVE-2024-7868EPSS 0.4%

    In Xpdf 4.05 (and earlier), invalid header info in a DCT (JPEG) stream can lead to an uninitialized variable in the DCT decoder. The proof-of-concept PDF file causes a segfault attempting to read from an invalid address.

  3. 5.5CVE-2024-38122EPSS 0.6%

    Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability

  4. 5.5CVE-2024-38118EPSS 0.6%

    Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability

  5. 6.5CVE-2024-7526EPSS 0.6%

    ANGLE failed to initialize parameters which lead to reading from uninitialized memory. This could be leveraged to leak sensitive data from memory. This vulnerability affects Firefox < 129, Firefox ESR < 115.14, Firefox ESR < 128.1, Thunder…

  6. 3.3CVE-2024-7542EPSS 0.3%

    oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to…

  7. 3.3CVE-2024-7541EPSS 0.3%

    oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to …

  8. 3.3CVE-2024-7540EPSS 0.3%

    oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to…

  9. 7.8CVE-2024-33021EPSS 0.1%

    Memory corruption while processing IOCTL call to set metainfo.

  10. 8.8CVE-2024-6990EPSS 0.9%

    Uninitialized Use in Dawn in Google Chrome on Android prior to 127.0.6533.88 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)

  11. 7.0CVE-2024-42228EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To real…

  12. 7.5CVE-2024-42225EPSS 0.5%

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data

  13. 6.3CVE-2024-42161EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a default branch in the switch statement to initialize `val'.] GCC warns that `val' ma…

  14. 5.5CVE-2024-42129EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: leds: mlxreg: Use devm_mutex_init() for mutex initialization In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered…

  15. 5.5CVE-2024-42128EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: leds: an30259a: Use devm_mutex_init() for mutex initialization In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregister…

  16. 5.5CVE-2024-42113EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts When using MSI/INTx interrupts, wx->num_q_vectors is uninitialized. Thus there will be kernel panic in wx_al…

  17. 5.5CVE-2024-42106EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: inet_diag: Initialize pad field in struct inet_diag_req_v2 KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw sockets uses the pad field in struct inet…

  18. 5.5CVE-2024-42096EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() The 'profile_pc()' function is used for timer-based profiling, which isn't really all that relevant any more to begin with,…

  19. 5.5CVE-2024-42076EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: Initialize unused data in j1939_send_one() syzbot reported kernel-infoleak in raw_recvmsg() [1]. j1939_send_one() creates full frame including unused da…

  20. 5.5CVE-2024-42063EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode syzbot reported uninit memory usages during map_{lookup,delete}_elem. ========== BUG: KMSAN: uni…

  21. 7.1CVE-2024-41059EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus…

  22. 5.5CVE-2024-41052EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Init the count variable in collecting hot-reset devices The count variable is used without initialization, it results in mistakes in the device counting and cr…

  23. 5.5CVE-2022-48864EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, present…

  24. 5.5CVE-2022-48807EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler Currently, the same handler is called for both a NETDEV_BONDING_INFO LAG unlink notification as for a NETDEV_UNREGI…

  25. 5.5CVE-2024-40998EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() In the following concurrency we will access the uninitialized rs->lock: ext4_fill_super ex…

  26. 5.5CVE-2024-40931EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure snd_una is properly initialized on connect This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It…

  27. 5.5CVE-2024-40926EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't attempt to schedule hpd_work on headless cards If the card doesn't have display hardware, hpd_work and hpd_lock are left uninitialized which causes BU…

  28. 5.5CVE-2024-39507EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash problem in concurrent scenario When link status change, the nic driver need to notify the roce driver to handle this event, but at this time,…

  29. 5.5CVE-2024-39491EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance The cs_dsp instance is initialized in the driver probe() so it should be freed in the driver remove(). Also fix a mis…

  30. 7.5CVE-2024-38064EPSS 2.2%

    Windows TCP/IP Information Disclosure Vulnerability

  31. 7.8CVE-2024-23159EPSS 0.3%

    A maliciously crafted STP file, when parsed in stp_aim_x64_vc15d.dll through Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, can lead to code execution in the current pro…

  32. 7.8CVE-2024-37002EPSS 0.4%

    A maliciously crafted MODEL file, when parsed in ASMkern229A.dllthrough Autodesk applications, can be used to uninitialized variables. This vulnerability, along with other vulnerabilities, could lead to code execution in the current proces…

  33. 7.1CVE-2024-38381EPSS 0.4%

    In the Linux kernel, the following vulnerability has been resolved: nfc: nci: Fix uninit-value in nci_rx_work syzbot reported the following uninit-value access issue [1] nci_rx_work() parses received packet from ndev->rx_q. It should be…

  34. 5.5CVE-2024-33619EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: efi: libstub: only free priv.runtime_map when allocated priv.runtime_map is only allocated when efi_novamap is not set. Otherwise, it is an uninitialized value. In the …

  35. 7.5CVE-2022-48747EPSS 0.9%

    In the Linux kernel, the following vulnerability has been resolved: block: Fix wrong offset in bio_truncate() bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of pag…

  36. 5.5CVE-2024-38619EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Check whether the media is initialized The member "uzonesize" of struct alauda_info will remain 0 if alauda_init_media() fails, potentially causing …

  37. 5.5CVE-2021-47597EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: inet_diag: fix kernel-infoleak for UDP sockets KMSAN reported a kernel-infoleak [1], that can exploited by unpriv users. After analysis it turned out UDP was not initia…

  38. 5.5CVE-2021-47583EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: media: mxl111sf: change mutex_init() location Syzbot reported, that mxl111sf_ctrl_msg() uses uninitialized mutex. The problem was in wrong mutex_init() location. Previo…

  39. 5.5CVE-2024-38593EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: net: micrel: Fix receiving the timestamp in the frame for lan8841 The blamed commit started to use the ptp workqueue to get the second part of the timestamp. And when th…

  40. 5.5CVE-2024-38592EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Init `ddp_comp` with devm_kcalloc() In the case where `conn_routes` is true we allocate an extra slot in the `ddp_comp` array but mtk_drm_crtc_create() nev…

  41. 7.1CVE-2024-38538EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an uninit value[1] error in bridge device's xmit path by sending a short (less than E…

  42. 5.5CVE-2024-36503EPSS 0.1%

    Memory management vulnerability in the Gralloc module Impact: Successful exploitation of this vulnerability will affect availability.

  43. 5.5CVE-2024-32910EPSS 0.08%

    In handle_msg_shm_map_req of trusty/user/base/lib/spi/srv/tipc/tipc.c, there is a possible stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. Use…

  44. 7.8CVE-2024-32906EPSS 0.09%

    In AcvpOnMessage of avcp.cpp, there is a possible EOP due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  45. 5.5CVE-2024-29785EPSS 0.08%

    In aur_get_state of aurora.c, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…

  46. 5.5CVE-2024-29780EPSS 0.08%

    In hwbcc_ns_deprivilege of trusty/user/base/lib/hwbcc/client/hwbcc.c, there is a possible uninitialized stack data disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privilege…

  47. 5.3CVE-2024-36454EPSS 0.5%

    Use of uninitialized resource issue exists in IPCOM EX2 Series (V01L0x Series) V01L07NF0201 and earlier, and IPCOM VE2 Series V01L07NF0201 and earlier. If this vulnerability is exploited, the system may be rebooted or suspended by receivin…

  48. 5.5CVE-2024-36933EPSS 0.3%

    In the Linux kernel, the following vulnerability has been resolved: nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). syzbot triggered various splats (see [0] and links) by a crafted GSO packet of VIRTIO…

  49. 4.7CVE-2024-36927EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in __ip_make_skb() KMSAN reported uninit-value access in __ip_make_skb() [1]. __ip_make_skb() tests HDRINCL to know if the skb has icmphdr…

  50. 5.5CVE-2024-36903EPSS 0.2%

    In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix potential uninit-value access in __ip6_make_skb() As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FL…