Page History

...

In this noncompliant code example described in "More Randomness or Less" [Wang 2012], the process ID, time of day, and uninitialized memory junk is used to seed a random number generator. This behavior is characteristic of some distributions derived from Debian Linux that use uninitialized memory as a source of entropy because the value stored in junk is indeterminate. However, because accessing an indeterminate value is undefined behavior 11, compilers may optimize out the uninitialized variable access completely, leaving leaving only the time and process ID and resulting in a loss of desired entropy.

...

Reading uninitialized variables is undefined behavior 20 and can result in unexpected program behavior. In some cases, these security flaws may allow the execution of arbitrary code.

Reading uninitialized variables for creating entropy is problematic because these memory accesses can be removed by compiler optimization. VU#925211 is an example of a vulnerability caused by this coding error.

Rule	Severity	Likelihood	Detectable	Remediation CostRepairable	Priority	Level
EXP33-C	High	Probable	No	MediumYes	P12	L1

Automated Detection

Tool Version Checker Description

Astrée

Include Page

	Astrée_V
	Astrée_V

uninitialized-local-read

uninitialized-variable-use

Fully checked

Axivion Bauhaus Suite

Include Page

	Axivion Bauhaus Suite_V
	Axivion Bauhaus Suite_V

CertC-EXP33

CodeSonar

Include Page

	CodeSonar_V
	CodeSonar_V

LANG.MEM.UVAR

Uninitialized variable

Compass/ROSE

Automatically detects simple violations of this rule, although it may return some false positives. It may not catch more complex violations, such as initialization within functions taking uninitialized variables as arguments. It does catch the second noncompliant code example, and can be extended to catch the first as well

Coverity

Include Page

	Coverity_V
	Coverity_V

UNINIT

Implemented

Cppcheck

Include Page

	Cppcheck_V
	Cppcheck_V

uninitvar
uninitdata
uninitstring
uninitMemberVar
uninitStructMember

Cppcheck Premium

Include Page

	Cppcheck Premium_V
	Cppcheck Premium_V

uninitvar
uninitdata
uninitstring
uninitMemberVar
uninitStructMember

GCC

4.3.5

Can detect some violations of this rule when the -Wuninitialized flag is used

Helix QAC

Include Page

	Helix QAC_V
	Helix QAC_V

DF2726, DF2727, DF2728, DF2961, DF2962, DF2963, DF2966, DF2967, DF2968, DF2971, DF2972, DF2973, DF2976, DF2977, DF2978

Fully implemented

Klocwork

Include Page

	Klocwork_V
	Klocwork_V

UNINIT.HEAP.MIGHT
UNINIT.HEAP.MUST
UNINIT.STACK.ARRAY.MIGHT
UNINIT.STACK.ARRAY.MUST
UNINIT.STACK.ARRAY.PARTIAL.MUST
UNINIT.STACK.MIGHT
UNINIT.STACK.MUST

Fully implemented

LDRA tool suite

Include Page