1001
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 667 Improper Locking 1464
CanAlsoBe 410 Insufficient Resource Pool 998
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 411 Resource Locking Problems 2325
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (Other)
When an attacker can control a lock, the program may wait
indefinitely until the attacker releases the lock, causing
a denial of service to other users of the program. This is
especially problematic if there is a blocking operation on
the lock.
Detection Methods
White Box
Automated code analysis techniques might not be able to reliably detect this weakness, since
the application's behavior and general security model dictate which resource locks are critical.
Interpretation of the weakness might require knowledge of the environment, e.g. if the existence
of a file is used as a lock, but the file is created in a world-writable directory.
Potential Mitigations
Phase: Architecture and Design
Phase: Implementation
Use any access control that is offered by the functionality that is offering the lock.
Phase: Architecture and Design
Phase: Implementation
Use unpredictable names or identifiers for the locks. This might not always be possible or
feasible.
Phase: Architecture and Design
Consider modifying your code to use non-blocking synchronization methods.
Demonstrative Examples
Example 1:
This code tries to obtain a lock for a file, then writes to it.
Example Language: PHP (Bad)
function writeToLog($message){
$logfile = fopen("logFile.log", "a");
//attempt to get logfile lock
CWE Version 4.14
CWE-412: Unrestricted Externally Accessible Lock
CWE-412: Unrestricted Externally Accessible Lock