CVE-2023-22356

Ensures shared resources are explicitly initialized or cleared on allocation, preventing exposure of prior contents to new users or processes.

Mandates that every instance begins in a known (presumably clean) state, eliminating reliance on residual or uninitialized state left by prior executions.

A.8.25 mandates security requirements, checkpoints, secure coding, testing and developer capability in the SDLC which reaches improper initialization as a design/coding defect, but leaves a bounded remainder (e.g. initialization of third-party components or libraries chosen in procurement, and post-deployment configuration defaults).

A.8.27 mandates security-by-design principles (least privilege, default-deny, fail-securely, distrust-external-input, hardening) plus explicit design reviews that can catch and block many uninitialized-resource cases before they ship, but leaves a bounded remainder (e.g. vendor libraries, runtime-initialization bugs, or post-review code changes) that can still be present and exploitable.

Secure coding standards explicitly forbid uninitialized variables and mandate proper resource initialization before use.

Security testing can detect uninitialized variables but does not itself enforce initialization practices.

defining, enforcing, and monitoring secure configuration templates (including defaults, disabled services, changed vendor passwords, minimized privileges) directly stops most improper-initialization cases from being exploitable; the bounded remainder is initialization logic inside custom application code that no configuration template reaches