905
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Use locking functionality. This is the recommended solution. Implement some form of locking
mechanism around code which alters or reads persistent data in a multithreaded environment.
Phase: Architecture and Design
Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags
and signals to enforce your own blocking scheme when resources are being used by other
threads of execution.
Demonstrative Examples
Example 1:
The following example demonstrates the weakness.
Example Language: C (Bad)
int foo = 0;
int storenum(int num) {
static int counter = 0;
counter++;
if (num > foo) foo = num;
return foo;
}
Example Language: Java (Bad)
public classRace {
static int foo = 0;
public static void main() {
new Threader().start();
foo = 1;
}
public static class Threader extends Thread {
public void run() {
System.out.println(foo);
}
}
}
Observed Examples
Reference Description
CVE-2022-2621 Chain: two threads in a web browser use the same resource (CWE-366), but
one of those threads can destroy the resource before the other has completed
(CWE-416).
https://www.cve.org/CVERecord?id=CVE-2022-2621
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition