CWE-563 is a dead store: a variable gets a value, and then the value is either overwritten or the variable goes out of scope without anything reading it.
Most of the time this is leftover clutter. MITRE says it is likely the variable is simply vestigial, but it is also possible that the unused variable points to a bug. That second possibility is why it earns a place on the list. When a developer assigns a result and then never reads it, one of two things is true: the assignment was pointless, or the code that should have used the value is missing.
The weakness is not language specific.
How it happens
MITRE's example shows a C fragment that assigns to r and then overwrites it before use:
r = getName();
r = getNewBuffer(buf);
The first value is lost. If getName() allocates memory, it may also leak. If the programmer meant to use the name and forgot, a feature silently does nothing.
A security flavored version looks like this:
// Suspicious: the check result is assigned and never used
boolean allowed = user.hasPermission("export");
exportReport(user); // runs regardless
The developer clearly meant if (allowed). The dead store is the only clue that the check was dropped.
Other causes: copy and paste, half finished refactors, and error codes captured in a variable that nobody tests.
What an attacker gains
MITRE lists quality degradation, varying by context. A dead store does not give an attacker anything directly. It can indicate a bug, or a deprecated variable that was never removed, and MITRE notes it could lead to further bugs and weaknesses.
The risk is the missing behavior. If the unused value was a permission result, a return code or a validation outcome, the program is behaving as if the check passed.
How to find it
Automated static analysis can find some instances, per MITRE. Compilers often warn about unused variables, and many analyzers specifically report dead stores. Enable those warnings. When one fires, do not just delete the line. First ask what the value was meant to do.
How to fix it
MITRE's mitigation: remove unused variables from the code.
- Read the surrounding code and decide whether the value was supposed to be used.
- If yes, add the missing use, such as the
ifaround the protected action, and add a test. - If no, delete the assignment and any now useless computation.
- Keep warnings for unused values enabled in your build.
// Fixed: the result is used
if (user.hasPermission("export")) {
exportReport(user);
}
The free in-browser scan at gold.safeguard.sh/scan lists the dependencies in your manifest. No login is needed, the file stays on your machine, and it handles up to 100 dependencies.
Quick check
Is a dead store always a bug?
No. It is often clutter. But it can be the only visible sign that a check or a use of a value is missing, so investigate before deleting.
What does MITRE recommend?
Remove unused variables from the code.
