cve.bz

CWE-908: Use of Uninitialized Resource, page 15

Filter

The product uses or accesses a resource that has not been initialized.

What the weakness is: CWE-908 at MITRE

Ask an AI about CWE-908

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-908: Use of Uninitialized Resource and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/908.html and https://cve.bz/cve/cwe/908?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.4CVE-2022-0494EPSS 0.4%

    A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues wi…

  2. 5.5CVE-2022-0433EPSS 0.3%

    A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kern…

  3. 5.3CVE-2021-21966EPSS 1.4%

    An information disclosure vulnerability exists in the HTTP Server /ping.html functionality of Texas Instruments CC3200 SimpleLink Solution NWP 2.9.0.0. A specially-crafted HTTP request can lead to an uninitialized read. An attacker can sen…

  4. 8.8CVE-2022-0115EPSS 1.5%

    Uninitialized use in File API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

  5. 6.5CVE-2021-39671EPSS 0.5%

    In code generated by aidl_const_expressions.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to information disclosure with no additional execution privileges needed. User interaction is not needed for…

  6. 8.8CVE-2022-23573EPSS 0.8%

    Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand…

  7. 3.3CVE-2022-24448EPSS 0.4%

    An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR shou…

  8. 5.9CVE-2021-43848EPSS 2.7%

    h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninit…

  9. 4.4CVE-2021-39680EPSS 0.1%

    In sec_SHA256_Transform of sha256_core.c, there is a possible way to read heap data due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for expl…

  10. 4.4CVE-2022-20018EPSS 0.1%

    In seninf driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALP…

  11. 4.4CVE-2022-20015EPSS 0.1%

    In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch I…

  12. 9.8CVE-2021-45703EPSS 1.2%

    An issue was discovered in the tectonic_xdv crate before 0.1.12 for Rust. XdvParser::<T>::process may read from uninitialized memory locations.

  13. 7.5CVE-2021-45694EPSS 1.1%

    An issue was discovered in the rdiff crate through 2021-02-03 for Rust. Window may read from uninitialized memory locations.

  14. 9.8CVE-2021-45693EPSS 1.2%

    An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.

  15. 9.8CVE-2021-45692EPSS 1.4%

    An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_extension_others may read from uninitialized memory locations.

  16. 9.8CVE-2021-45691EPSS 1.2%

    An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.

  17. 9.8CVE-2021-45690EPSS 1.2%

    An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.

  18. 9.8CVE-2021-45689EPSS 1.2%

    An issue was discovered in the gfx-auxil crate through 2021-01-07 for Rust. gfx_auxil::read_spirv may read from uninitialized memory locations.

  19. 9.8CVE-2021-45688EPSS 1.4%

    An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.

  20. 9.8CVE-2021-45686EPSS 1.2%

    An issue was discovered in the csv-sniffer crate through 2021-01-05 for Rust. preamble_skipcount may read from uninitialized memory locations.

  21. 9.8CVE-2021-45685EPSS 1.2%

    An issue was discovered in the columnar crate through 2021-01-07 for Rust. ColumnarReadExt::read_typed_vec may read from uninitialized memory locations.

  22. 9.8CVE-2021-45684EPSS 1.2%

    An issue was discovered in the flumedb crate through 2021-01-07 for Rust. read_entry may read from uninitialized memory locations.

  23. 9.8CVE-2021-45683EPSS 1.2%

    An issue was discovered in the binjs_io crate through 2021-01-03 for Rust. The Read method may read from uninitialized memory locations.

  24. 9.8CVE-2021-45682EPSS 1.2%

    An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.

  25. 9.8CVE-2020-36514EPSS 1.2%

    An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. fill_buf may read from uninitialized memory locations.

  26. 9.8CVE-2020-36513EPSS 1.2%

    An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.

  27. 9.8CVE-2020-36512EPSS 1.2%

    An issue was discovered in the buffoon crate through 2020-12-31 for Rust. InputStream::read_exact may read from uninitialized memory locations.

  28. 7.5CVE-2020-36511EPSS 1.1%

    An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.

  29. 7.5CVE-2018-25023EPSS 1.4%

    An issue was discovered in the smallvec crate before 0.6.13 for Rust. It can create an uninitialized value of any type, including a reference type.

  30. 9.8CVE-2021-40418EPSS 18%

    When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. U…

  31. 5.5CVE-2021-44003EPSS 0.8%

    A vulnerability has been identified in JT2Go (All versions < V13.2.0.5), Teamcenter Visualization (All versions < V13.2.0.5). The Tiff_Loader.dll is vulnerable to use of uninitialized memory while parsing user supplied TIFF files. This cou…

  32. 8.1CVE-2021-41253EPSS 1.9%

    Zydis is an x86/x86-64 disassembler library. Users of Zydis versions v3.2.0 and older that use the string functions provided in `zycore` in order to append untrusted user data to the formatter buffer within their custom formatter hooks can…

  33. 7.8CVE-2021-41225EPSS 0.2%

    TensorFlow is an open source platform for machine learning. In affected versions TensorFlow's Grappler optimizer has a use of unitialized variable. If the `train_nodes` vector (obtained from the saved model that gets optimized) does not co…

  34. 7.8CVE-2021-3928EPSS 0.6%

    vim is vulnerable to Use of Uninitialized Variable

  35. 6.5CVE-2021-34855EPSS 0.3%

    This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute low-privileged code on the target guest system …

  36. 5.5CVE-2021-0938EPSS 0.2%

    In memzero_explicit of compiler-clang.h, there is a possible bypass of defense in depth due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not need…

  37. 6.7CVE-2021-0634EPSS 0.1%

    In display driver, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05…

  38. 7.5CVE-2021-36512EPSS 1.0%

    An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uninitialized value.

  39. 9.1CVE-2021-1619EPSS 1.8%

    A vulnerability in the authentication, authorization, and accounting (AAA) function of Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass NETCONF or RESTCONF authentication and do either of the following: Insta…

  40. 7.8CVE-2021-29631EPSS 0.3%

    In FreeBSD 13.0-STABLE before n246941-20f96f215562, 12.2-STABLE before r370400, 11.4-STABLE before r370399, 13.0-RELEASE before p4, 12.2-RELEASE before p10, and 11.4-RELEASE before p13, certain VirtIO-based device models in bhyve failed to…

  41. 3.3CVE-2021-36007EPSS 1.5%

    Adobe Prelude version 10.0 (and earlier) are affected by an uninitialized variable vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to disclose arbitrary memory information …

  42. 3.3CVE-2021-21781EPSS 0.5%

    An information disclosure vulnerability exists in the ARM SIGPAGE functionality of Linux Kernel v5.4.66 and v5.4.54. The latest version (5.11-rc4) seems to still be vulnerable. A userland application can read the contents of the sigpage, w…

  43. 3.3CVE-2021-36282EPSS 0.2%

    Dell EMC PowerScale OneFS versions 8.2.x - 9.1.0.x contain a use of uninitialized resource vulnerability. This can potentially allow an authenticated user with ISI_PRIV_LOGIN_CONSOLE or ISI_PRIV_LOGIN_SSH privileges to gain access up to 24…

  44. 9.8CVE-2021-1104EPSS 1.7%

    The RISC-V Instruction Set Manual contains a documented ambiguity for the Machine Trap Vector Base Address (MTVEC) register that may lead to a vulnerability due to the initial state of the register not being defined, potentially leading to…

  45. 7.1CVE-2021-37682EPSS 0.2%

    TensorFlow is an end-to-end open source platform for machine learning. In affected versions all TFLite operations that use quantization can be made to use unitialized values. [For example](https://github.com/tensorflow/tensorflow/blob/460e…

  46. 9.8CVE-2020-36452EPSS 1.1%

    An issue was discovered in the array-tools crate before 0.3.2 for Rust. FixedCapacityDequeLike::clone() has a drop of uninitialized memory.

  47. 9.8CVE-2020-36443EPSS 1.2%

    An issue was discovered in the libp2p-deflate crate before 0.27.1 for Rust. An uninitialized buffer is passed to AsyncRead::poll_read(), which is a user-provided trait function.

  48. 9.8CVE-2020-36432EPSS 1.2%

    An issue was discovered in the alg_ds crate through 2020-08-25 for Rust. There is a drop of uninitialized memory in Matrix::new().

  49. 5.3CVE-2021-22925EPSS 5.4%

    curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcu…

  50. 8.8CVE-2021-30578EPSS 1.7%

    Uninitialized use in Media in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.