CWE-667: Improper Locking

Description

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.

Potential Impact

Demonstrative Examples

private long someLongValue;public long getLongValue() {return someLongValue;}
                     public void setLongValue(long l) {someLongValue = l;}

function writeToLog($message){$logfile = fopen("logFile.log", "a");
                        //attempt to get logfile lock
                        if (flock($logfile, LOCK_EX)) {fwrite($logfile,$message);
                           // unlock logfile
                           flock($logfile, LOCK_UN);}else {print "Could not obtain lock on logFile.log, message not recorded\n";}}fclose($logFile);

void f(pthread_mutex_t *mutex) {
                        pthread_mutex_lock(mutex);
                           
                           /* access shared resource */
                           
                           
                           pthread_mutex_unlock(mutex);
                     }

int f(pthread_mutex_t *mutex) {
                        int result;
                           result = pthread_mutex_lock(mutex);if (0 != result)return result;
                           
                           
                           /* access shared resource */
                           
                           
                           return pthread_mutex_unlock(mutex);
                     }

if (helper == null) {
                        synchronized (this) {if (helper == null) {helper = new Helper();}}
                     }return helper;

helper = new Helper();

Mitigations & Prevention

Detection Methods

• Automated Static Analysis High — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

Showing 15 of 26 observed examples.

Related Weaknesses

Taxonomy Mappings

• CERT C Secure Coding: CON31-C — Do not destroy a mutex while it is locked
• CERT C Secure Coding: POS48-C — Do not unlock or destroy another POSIX thread's mutex
• The CERT Oracle Secure Coding Standard for Java (2011): VNA00-J — Ensure visibility when accessing shared primitive variables
• The CERT Oracle Secure Coding Standard for Java (2011): VNA02-J — Ensure that compound operations on shared variables are atomic
• The CERT Oracle Secure Coding Standard for Java (2011): VNA05-J — Ensure atomicity when reading and writing 64-bit values
• The CERT Oracle Secure Coding Standard for Java (2011): LCK06-J — Do not use an instance lock to protect shared static data
• Software Fault Patterns: SFP19 — Missing Lock
• OMG ASCSM: ASCSM-CWE-667 —