1006
balanceChangeLock.lock();
try {
double newBalance = balance + amount;
balance = newBalance;
// inform other threads that funds are available
sufficientFundsCondition.signalAll();
} catch (Exception e) {...}
finally {
// unlock lock object
balanceChangeLock.unlock();
}
}
// method to withdraw amount from bank account
public void withdraw(double amount) {
// set lock to block access to BankAccount from other threads
balanceChangeLock.lock();
try {
while (balance < amount) {
// temporarily unblock access
// until sufficient funds are available
sufficientFundsCondition.await();
}
double newBalance = balance - amount;
balance = newBalance;
} catch (Exception e) {...}
finally {
// unlock lock object
balanceChangeLock.unlock();
}
}
...
}
Observed Examples
Reference Description
CVE-2022-20141 Chain: an operating system kernel has insufficent resource locking (CWE-413)
leading to a use after free (CWE-416).
https://www.cve.org/CVERecord?id=CVE-2022-20141
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 852 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 9 - Visibility and Atomicity (VNA)
844 2366
MemberOf 853 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 10 - Locking (LCK)
844 2366
MemberOf 986 SFP Secondary Cluster: Missing Lock 888 2411
MemberOf 1142 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 08. Visibility and Atomicity (VNA)
1133 2448
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Insufficient Resource Locking
The CERT Oracle Secure
Coding Standard for Java
(2011)
VNA00-J Ensure visibility when accessing shared
primitive variables
CWE Version 4.14
CWE-414: Missing Lock Check
CWE-414: Missing Lock Check