888
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
Nature Type ID Name Page
ChildOf 662 Improper Synchronization 1448
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 662 Improper Synchronization 1448
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 557 Concurrency Issues 2329
Applicable Platforms
Language : C (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Language : Java (Prevalence = Undetermined)
Language : C# (Prevalence = Undetermined)
Likelihood Of Exploit
Medium
Common Consequences
Scope Impact Likelihood
Integrity
Other
Alter Execution Logic
Unexpected State
The main problem is that -- if a lock is overcome -- data
could be altered in a bad state.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
CWE Version 4.14
CWE-366: Race Condition within a Thread
CWE-366: Race Condition within a Thread