{"@ID": "667", "@Name": "Improper Locking", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Draft", "Description": "The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.", "Extended_Description": {"xhtml:p": "Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process.  This can lead to data or memory corruption, denial of service, etc."}, "Related_Weaknesses": {"Related_Weakness": [{"@Nature": "ChildOf", "@CWE_ID": "662", "@View_ID": "1000", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "662", "@View_ID": "1003", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "662", "@View_ID": "1305", "@Ordinal": "Primary"}, {"@Nature": "ChildOf", "@CWE_ID": "662", "@View_ID": "1340", "@Ordinal": "Primary"}]}, "Weakness_Ordinalities": {"Weakness_Ordinality": {"Ordinality": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design"}, {"Phase": "Implementation"}]}, "Common_Consequences": {"Consequence": {"Scope": "Availability", "Impact": "DoS: Resource Consumption (CPU)", "Note": "Inconsistent locking discipline can lead to deadlock."}}, "Detection_Methods": {"Detection_Method": {"@Detection_Method_ID": "DM-14", "Method": "Automated Static Analysis", "Description": "Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect \"sources\" (origins of input) with \"sinks\" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)", "Effectiveness": "High"}}, "Potential_Mitigations": {"Mitigation": {"Phase": "Implementation", "Strategy": "Libraries or Frameworks", "Description": "Use industry standard APIs to implement locking mechanism."}}, "Demonstrative_Examples": {"Demonstrative_Example": [{"Intro_Text": "In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized.", "Example_Code": {"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:br": [null, null, null], "xhtml:div": [{"@style": "margin-left:1em;", "#text": "return someLongValue;"}, {"@style": "margin-left:1em;", "#text": "someLongValue = l;"}], "#text": "private long someLongValue;public long getLongValue() {}\n                     public void setLongValue(long l) {}"}}}, {"@Demonstrative_Example_ID": "DX-69", "Intro_Text": "This code tries to obtain a lock for a file, then writes to it.", "Example_Code": {"@Nature": "Bad", "@Language": "PHP", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:br": [null, null, null], "xhtml:i": "//attempt to get logfile lock", "xhtml:div": [{"@style": "margin-left:1em;", "xhtml:br": [null, null], "xhtml:i": "// unlock logfile", "#text": "fwrite($logfile,$message);\n                           \n                           flock($logfile, LOCK_UN);"}, {"@style": "margin-left:1em;", "#text": "print \"Could not obtain lock on logFile.log, message not recorded\\n\";"}], "#text": "$logfile = fopen(\"logFile.log\", \"a\");\n                        \n                        if (flock($logfile, LOCK_EX)) {}else {}"}, "xhtml:br": null, "#text": "function writeToLog($message){}fclose($logFile);"}}, "Body_Text": "PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock()."}, {"@Demonstrative_Example_ID": "DX-24", "Intro_Text": "The following function attempts to acquire a lock in order to perform operations on a shared resource.", "Example_Code": [{"@Nature": "Bad", "@Language": "C", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null], "xhtml:i": "/* access shared resource */", "#text": "pthread_mutex_lock(mutex);\n                           \n                           \n                           \n                           \n                           pthread_mutex_unlock(mutex);"}}, "#text": "void f(pthread_mutex_t *mutex) {}"}}, {"@Nature": "Good", "@Language": "C", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:br": [null, null, null, null, null, null, null, null], "xhtml:div": {"@style": "margin-left:1em;", "#text": "return result;"}, "xhtml:i": "/* access shared resource */", "#text": "int result;\n                           result = pthread_mutex_lock(mutex);if (0 != result)\n                           \n                           \n                           \n                           \n                           \n                           return pthread_mutex_unlock(mutex);"}}, "#text": "int f(pthread_mutex_t *mutex) {}"}}], "Body_Text": ["However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.", "In order to avoid data races, correctly written programs must check the result of thread synchronization functions and appropriately handle all errors, either by attempting to recover from them or reporting them to higher levels."]}, {"@Demonstrative_Example_ID": "DX-70", "Intro_Text": "It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...", "Example_Code": [{"@Nature": "Bad", "@Language": "Java", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"xhtml:div": {"@style": "margin-left:1em;", "xhtml:div": {"@style": "margin-left:1em;", "#text": "helper = new Helper();"}, "#text": "if (helper == null) {}"}, "#text": "synchronized (this) {}"}}, "xhtml:br": null, "#text": "if (helper == null) {}return helper;"}}, {"@Nature": "Bad", "@Language": "Java", "xhtml:div": "helper = new Helper();"}], "Body_Text": ["The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.", "Suppose that helper is not initialized. Then, thread A sees that helper==null and enters the synchronized block and begins to execute:", "If a second thread, thread B, takes over in the middle of this call and helper has not finished running the constructor, then thread B may make calls on helper while its fields hold incorrect values."]}]}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2021-1782", "Description": "Chain: improper locking (CWE-667) leads to race condition (CWE-362), as exploited in the wild per CISA KEV.", "Link": "https://www.cve.org/CVERecord?id=CVE-2021-1782"}, {"Reference": "CVE-2009-0935", "Description": "Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-0935"}, {"Reference": "CVE-2010-4210", "Description": "function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory.", "Link": "https://www.cve.org/CVERecord?id=CVE-2010-4210"}, {"Reference": "CVE-2008-4302", "Description": "Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.", "Link": "https://www.cve.org/CVERecord?id=CVE-2008-4302"}, {"Reference": "CVE-2009-1243", "Description": "OS kernel performs an unlock in some incorrect circumstances, leading to panic.", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-1243"}, {"Reference": "CVE-2009-2857", "Description": "OS deadlock", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-2857"}, {"Reference": "CVE-2009-1961", "Description": "OS deadlock involving 3 separate functions", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-1961"}, {"Reference": "CVE-2009-2699", "Description": "deadlock in library", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-2699"}, {"Reference": "CVE-2009-4272", "Description": "deadlock triggered by packets that force collisions in a routing table", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-4272"}, {"Reference": "CVE-2002-1850", "Description": "read/write deadlock between web server and script", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1850"}, {"Reference": "CVE-2004-0174", "Description": "web server deadlock involving multiple listening connections", "Link": "https://www.cve.org/CVERecord?id=CVE-2004-0174"}, {"Reference": "CVE-2009-1388", "Description": "multiple simultaneous calls to the same function trigger deadlock.", "Link": "https://www.cve.org/CVERecord?id=CVE-2009-1388"}, {"Reference": "CVE-2006-5158", "Description": "chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833).", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-5158"}, {"Reference": "CVE-2006-4342", "Description": "deadlock when an operation is performed on a resource while it is being removed.", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-4342"}, {"Reference": "CVE-2006-2374", "Description": "Deadlock in device driver triggered by using file handle of a related device.", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-2374"}, {"Reference": "CVE-2006-2275", "Description": "Deadlock when large number of small messages cannot be processed quickly enough.", "Link": "https://www.cve.org/CVERecord?id=CVE-2006-2275"}, {"Reference": "CVE-2005-3847", "Description": "OS kernel has deadlock triggered by a signal during a core dump.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-3847"}, {"Reference": "CVE-2005-3106", "Description": "Race condition leads to deadlock.", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-3106"}, {"Reference": "CVE-2005-2456", "Description": "Chain: array index error (CWE-129) leads to deadlock (CWE-833)", "Link": "https://www.cve.org/CVERecord?id=CVE-2005-2456"}, {"Reference": "CVE-2001-0682", "Description": "Program can not execute when attacker obtains a mutex.", "Link": "https://www.cve.org/CVERecord?id=CVE-2001-0682"}, {"Reference": "CVE-2002-1914", "Description": "Program can not execute when attacker obtains a lock on a critical output file.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1914"}, {"Reference": "CVE-2002-1915", "Description": "Program can not execute when attacker obtains a lock on a critical output file.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1915"}, {"Reference": "CVE-2002-0051", "Description": "Critical file can be opened with exclusive read access by user, preventing application of security policy. Possibly related to improper permissions, large-window race condition.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-0051"}, {"Reference": "CVE-2000-0338", "Description": "Chain: predictable file names used for locking, allowing attacker to create the lock beforehand. Resultant from permissions and randomness.", "Link": "https://www.cve.org/CVERecord?id=CVE-2000-0338"}, {"Reference": "CVE-2000-1198", "Description": "Chain: Lock files with predictable names. Resultant from randomness.", "Link": "https://www.cve.org/CVERecord?id=CVE-2000-1198"}, {"Reference": "CVE-2002-1869", "Description": "Product does not check if it can write to a log file, allowing attackers to avoid logging by accessing the file using an exclusive lock. Overlaps unchecked error condition. This is not quite CWE-412, but close.", "Link": "https://www.cve.org/CVERecord?id=CVE-2002-1869"}]}, "Taxonomy_Mappings": {"Taxonomy_Mapping": [{"@Taxonomy_Name": "CERT C Secure Coding", "Entry_ID": "CON31-C", "Entry_Name": "Do not destroy a mutex while it is locked", "Mapping_Fit": "CWE More Abstract"}, {"@Taxonomy_Name": "CERT C Secure Coding", "Entry_ID": "POS48-C", "Entry_Name": "Do not unlock or destroy another POSIX thread's mutex", "Mapping_Fit": "CWE More Abstract"}, {"@Taxonomy_Name": "The CERT Oracle Secure Coding Standard for Java (2011)", "Entry_ID": "VNA00-J", "Entry_Name": "Ensure visibility when accessing shared primitive variables"}, {"@Taxonomy_Name": "The CERT Oracle Secure Coding Standard for Java (2011)", "Entry_ID": "VNA02-J", "Entry_Name": "Ensure that compound operations on shared variables are atomic"}, {"@Taxonomy_Name": "The CERT Oracle Secure Coding Standard for Java (2011)", "Entry_ID": "VNA05-J", "Entry_Name": "Ensure atomicity when reading and writing 64-bit values"}, {"@Taxonomy_Name": "The CERT Oracle Secure Coding Standard for Java (2011)", "Entry_ID": "LCK06-J", "Entry_Name": "Do not use an instance lock to protect shared static data"}, {"@Taxonomy_Name": "Software Fault Patterns", "Entry_ID": "SFP19", "Entry_Name": "Missing Lock"}, {"@Taxonomy_Name": "OMG ASCSM", "Entry_ID": "ASCSM-CWE-667"}]}, "Related_Attack_Patterns": {"Related_Attack_Pattern": [{"@CAPEC_ID": "25"}, {"@CAPEC_ID": "26"}, {"@CAPEC_ID": "27"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-962", "@Section": "ASCSM-CWE-667"}}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE entry is a Class and might have Base-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Notes": {"Note": {"@Type": "Maintenance", "#text": "Deeper research is necessary for synchronization and related mechanisms, including locks, mutexes, semaphores, and other mechanisms. Multiple entries are dependent on this research, which includes relationships to concurrency, race conditions, reentrant functions, etc.  CWE-662 and its children - including CWE-667, CWE-820, CWE-821, and others - may need to be modified significantly, along with their relationships."}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2008-04-11", "Submission_Version": "Draft 9", "Submission_ReleaseDate": "2008-04-11"}, "Modification": [{"Modification_Name": "Sean Eidemiller", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "added/updated demonstrative examples"}, {"Modification_Name": "Eric Dalci", "Modification_Organization": "Cigital", "Modification_Date": "2008-07-01", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Potential_Mitigations, Time_of_Introduction"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-09-08", "Modification_Version": "1.0", "Modification_ReleaseDate": "2008-09-09", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2008-11-24", "Modification_Version": "1.1", "Modification_ReleaseDate": "2008-11-25", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-03-10", "Modification_Version": "1.3", "Modification_ReleaseDate": "2009-03-10", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-05-27", "Modification_Version": "1.4", "Modification_ReleaseDate": "2009-05-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2009-07-27", "Modification_Version": "1.5", "Modification_ReleaseDate": "2009-07-27", "Modification_Comment": "updated Common_Consequences"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-09-27", "Modification_Version": "1.10", "Modification_ReleaseDate": "2010-09-27", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2010-12-13", "Modification_Version": "1.11", "Modification_ReleaseDate": "2010-12-13", "Modification_Comment": "updated Description, Name, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2011-06-01", "Modification_Version": "1.13", "Modification_ReleaseDate": "2011-06-01", "Modification_Comment": "updated Common_Consequences, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-05-11", "Modification_Version": "2.2", "Modification_ReleaseDate": "2012-05-15", "Modification_Comment": "updated Demonstrative_Examples, Observed_Examples, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2012-10-30", "Modification_Version": "2.3", "Modification_ReleaseDate": "2012-10-30", "Modification_Comment": "updated Potential_Mitigations"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2014-07-30", "Modification_Version": "2.8", "Modification_ReleaseDate": "2014-07-31", "Modification_Comment": "updated Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-05-03", "Modification_Version": "2.11", "Modification_ReleaseDate": "2017-05-05", "Modification_Comment": "updated Related_Attack_Patterns"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated References, Relationships, Taxonomy_Mappings"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-09-19", "Modification_Version": "3.4", "Modification_ReleaseDate": "2019-09-19", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-09-23", "Modification_Version": "3.4.1", "Modification_ReleaseDate": "2019-09-23", "Modification_Comment": "updated Description, Maintenance_Notes, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-02-24", "Modification_Version": "4.0", "Modification_ReleaseDate": "2020-02-24", "Modification_Comment": "updated Relationships, Type"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-08-20", "Modification_Version": "4.2", "Modification_ReleaseDate": "2020-08-20", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2020-12-10", "Modification_Version": "4.3", "Modification_ReleaseDate": "2020-12-10", "Modification_Comment": "updated Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2021-03-15", "Modification_Version": "4.4", "Modification_ReleaseDate": "2021-03-15", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2022-06-28", "Modification_Version": "4.8", "Modification_ReleaseDate": "2022-06-28", "Modification_Comment": "updated Observed_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-01-31", "Modification_Version": "4.10", "Modification_ReleaseDate": "2023-01-31", "Modification_Comment": "updated Description"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Detection_Factors, Relationships"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-04-03", "Modification_Version": "4.17", "Modification_ReleaseDate": "2025-04-03", "Modification_Comment": "updated Demonstrative_Examples"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2025-12-11", "Modification_Version": "4.19", "Modification_ReleaseDate": "2025-12-11", "Modification_Comment": "updated Applicable_Platforms, Weakness_Ordinalities"}], "Previous_Entry_Name": {"@Date": "2010-12-13", "#text": "Insufficient Locking"}}}