1363
Extended Description
Double-checked locking refers to the situation where a programmer checks to see if a resource
has been initialized, grabs a lock, checks again to see if the resource has been initialized, and then
performs the initialization if it has not occurred yet. This should not be done, as it is not guaranteed
to work in all languages and on all architectures. In summary, other threads may not be operating
inside the synchronous block and are not guaranteed to see the operations execute in the same
order as they would appear inside the synchronous block.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 667 Improper Locking 1464
CanPrecede 367 Time-of-check Time-of-use (TOCTOU) Race Condition 906
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 411 Resource Locking Problems 2325
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity
Other
Modify Application Data
Alter Execution Logic
Potential Mitigations
Phase: Implementation
While double-checked locking can be achieved in some languages, it is inherently flawed in Java
before 1.5, and cannot be achieved without compromising platform independence. Before Java
1.5, only use of the synchronized keyword is known to work. Beginning in Java 1.5, use of the
"volatile" keyword allows double-checked locking to work successfully, although there is some
debate as to whether it achieves sufficient performance gains. See references.
Demonstrative Examples
Example 1:
It may seem that the following bit of code achieves thread safety while avoiding unnecessary
synchronization...
Example Language: Java (Bad)
if (helper == null) {
synchronized (this) {
if (helper == null) {
helper = new Helper();
}
}
}
return helper;
CWE Version 4.14
CWE-610: Externally Controlled Reference to a Resource in Another Sphere
CWE-610: Externally Controlled Reference to a Resource in Another Sphere