1465
Relevant to the view "CISQ Data Protection Measures" (CWE-1340)
Nature Type ID Name Page
ChildOf 662 Improper Synchronization 1448
Common Consequences
Scope Impact Likelihood
Availability DoS: Resource Consumption (CPU)
Inconsistent locking discipline can lead to deadlock.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Strategy = Libraries or Frameworks
Use industry standard APIs to implement locking mechanism.
Demonstrative Examples
Example 1:
In the following Java snippet, methods are defined to get and set a long field in an instance of a
class that is shared across multiple threads. Because operations on double and long are nonatomic
in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and
double fields should be synchronized.
Example Language: Java (Bad)
private long someLongValue;
public long getLongValue() {
return someLongValue;
}
public void setLongValue(long l) {
someLongValue = l;
}
Example 2:
This code tries to obtain a lock for a file, then writes to it.
Example Language: PHP (Bad)
function writeToLog($message){
$logfile = fopen("logFile.log", "a");
//attempt to get logfile lock
if (flock($logfile, LOCK_EX)) {
fwrite($logfile,$message);
// unlock logfile
flock($logfile, LOCK_UN);
}
else {
print "Could not obtain lock on logFile.log, message not recorded\n";
}
CWE Version 4.14
CWE-667: Improper Locking
CWE-667: Improper Locking