1002
if (flock($logfile, LOCK_EX)) {
fwrite($logfile,$message);
// unlock logfile
flock($logfile, LOCK_UN);
}
else {
print "Could not obtain lock on logFile.log, message not recorded\n";
}
}
fclose($logFile);
PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the
file lock, this code will pause execution, possibly leading to denial of service for other users. Note
that in this case, if an attacker can perform an flock() on the file, they may already have privileges
to destroy the log file. However, this still impacts the execution of other programs that depend on
flock().
Observed Examples
Reference Description
CVE-2001-0682 Program can not execute when attacker obtains a mutex.
https://www.cve.org/CVERecord?id=CVE-2001-0682
CVE-2002-1914 Program can not execute when attacker obtains a lock on a critical output file.
https://www.cve.org/CVERecord?id=CVE-2002-1914
CVE-2002-1915 Program can not execute when attacker obtains a lock on a critical output file.
https://www.cve.org/CVERecord?id=CVE-2002-1915
CVE-2002-0051 Critical file can be opened with exclusive read access by user, preventing
application of security policy. Possibly related to improper permissions, largewindow
race condition.
https://www.cve.org/CVERecord?id=CVE-2002-0051
CVE-2000-0338 Chain: predictable file names used for locking, allowing attacker to create the
lock beforehand. Resultant from permissions and randomness.
https://www.cve.org/CVERecord?id=CVE-2000-0338
CVE-2000-1198 Chain: Lock files with predictable names. Resultant from randomness.
https://www.cve.org/CVERecord?id=CVE-2000-1198
CVE-2002-1869 Product does not check if it can write to a log file, allowing attackers to avoid
logging by accessing the file using an exclusive lock. Overlaps unchecked
error condition. This is not quite CWE-412, but close.
https://www.cve.org/CVERecord?id=CVE-2002-1869
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 361 7PK - Time and State 700 2320
MemberOf 730 OWASP Top Ten 2004 Category A9 - Denial of Service 711 2339
MemberOf 853 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 10 - Locking (LCK)
844 2366
MemberOf 989 SFP Secondary Cluster: Unrestricted Lock 888 2413
MemberOf 1143 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 09. Locking (LCK)
1133 2449
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Notes
Relationship
CWE Version 4.14
CWE-413: Improper Resource Locking
CWE-413: Improper Resource Locking