CWE-667: Improper Locking

Export to Word

Description

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Extended Description

Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.

ThreatScore

Threat Mapped score: 1.9

Industry: Finiancial

Threat priority: P3 - Important (Medium)

Observed Examples (CVEs)

Related Attack Patterns (CAPEC)

Attack TTPs

Malware

Modes of Introduction

Phase Note
Architecture and Design N/A
Implementation N/A

Common Consequences

Potential Mitigations

Applicable Platforms

Demonstrative Examples

Intro: In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized.

private long someLongValue; public long getLongValue() { return someLongValue; } public void setLongValue(long l) { someLongValue = l; }

Intro: This code tries to obtain a lock for a file, then writes to it.

Body: PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock().

function writeToLog($message){ $logfile = fopen("logFile.log", "a"); //attempt to get logfile lock if (flock($logfile, LOCK_EX)) { fwrite($logfile,$message); // unlock logfile flock($logfile, LOCK_UN); } else { print "Could not obtain lock on logFile.log, message not recorded\n"; } } fclose($logFile);

Intro: The following function attempts to acquire a lock in order to perform operations on a shared resource.

Body: However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.

void f(pthread_mutex_t *mutex) { pthread_mutex_lock(mutex); /* access shared resource */ pthread_mutex_unlock(mutex); }

Intro: It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...

Body: The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.

if (helper == null) { synchronized (this) { if (helper == null) { helper = new Helper(); } } } return helper;

Notes

← Back to CWE list