HackTricks
HackTricks Training Twitter Linkedin Sponsor

Uninitialized Variables

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

Basic Information

The core idea here is to understand what happens with uninitialized variables as they will have the value that was already in the assigned memory to them. Example:

  • Function 1: initializeVariable: We declare a variable x and assign it a value, let's say 0x1234. This action is akin to reserving a spot in memory and putting a specific value in it.

  • Function 2: useUninitializedVariable: Here, we declare another variable y but do not assign any value to it. In C, uninitialized variables don't automatically get set to zero. Instead, they retain whatever value was last stored at their memory location.

When we run these two functions sequentially:

  1. In initializeVariable, x is assigned a value (0x1234), which occupies a specific memory address.

  2. In useUninitializedVariable, y is declared but not assigned a value, so it takes the memory spot right after x. Due to not initializing y, it ends up "inheriting" the value from the same memory location used by x, because that's the last value that was there.

This behavior illustrates a key concept in low-level programming: Memory management is crucial, and uninitialized variables can lead to unpredictable behavior or security vulnerabilities, as they may unintentionally hold sensitive data left in memory.

Uninitialized stack variables could pose several security risks like:

  • Data Leakage: Sensitive information such as passwords, encryption keys, or personal details can be exposed if stored in uninitialized variables, allowing attackers to potentially read this data.

  • Information Disclosure: The contents of uninitialized variables might reveal details about the program's memory layout or internal operations, aiding attackers in developing targeted exploits.

  • Crashes and Instability: Operations involving uninitialized variables can result in undefined behavior, leading to program crashes or unpredictable outcomes.

  • Arbitrary Code Execution: In certain scenarios, attackers could exploit these vulnerabilities to alter the program's execution flow, enabling them to execute arbitrary code, which might include remote code execution threats.

Example

#include <stdio.h>

// Function to initialize and print a variable
void initializeAndPrint() {
    int initializedVar = 100; // Initialize the variable
    printf("Initialized Variable:\n");
    printf("Address: %p, Value: %d\n\n", (void*)&initializedVar, initializedVar);
}

// Function to demonstrate the behavior of an uninitialized variable
void demonstrateUninitializedVar() {
    int uninitializedVar; // Declare but do not initialize
    printf("Uninitialized Variable:\n");
    printf("Address: %p, Value: %d\n\n", (void*)&uninitializedVar, uninitializedVar);
}

int main() {
    printf("Demonstrating Initialized vs. Uninitialized Variables in C\n\n");

    // First, call the function that initializes its variable
    initializeAndPrint();

    // Then, call the function that has an uninitialized variable
    demonstrateUninitializedVar();

    return 0;
}

How This Works:

  • initializeAndPrint Function: This function declares an integer variable initializedVar, assigns it the value 100, and then prints both the memory address and the value of the variable. This step is straightforward and shows how an initialized variable behaves.

  • demonstrateUninitializedVar Function: In this function, we declare an integer variable uninitializedVar without initializing it. When we attempt to print its value, the output might show a random number. This number represents whatever data was previously at that memory location. Depending on the environment and compiler, the actual output can vary, and sometimes, for safety, some compilers might automatically initialize variables to zero, though this should not be relied upon.

  • main Function: The main function calls both of the above functions in sequence, demonstrating the contrast between an initialized variable and an uninitialized one.

ARM64 Example

This doesn't change at all in ARM64 as local variables are also managed in the stack, you can check this example were this is shown.

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

PreviousStack Pivoting - EBP2Ret - EBP chainingNextROP - Return Oriented Programing

Last updated