CWE-412: Unrestricted Externally Accessible Lock

Extended Description

This prevents the product from acting on associated resources or performing other behaviors that are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex, or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite period of time, then the denial of service could be permanent.

Code Examples & CVEs

Demonstrative Examples

This code tries to obtain a lock for a file, then writes to it.

PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock().

BadPHP

function writeToLog($message){$logfile = fopen("logFile.log", "a");                         //attempt to get logfile lock                         if (flock($logfile, LOCK_EX)) {fwrite($logfile,$message);                            // unlock logfile                            flock($logfile, LOCK_UN);}else {print "Could not obtain lock on logFile.log, message not recorded\n";}}fclose($logFile);

Observed CVE Examples (7)

CVE-2001-0682

Program can not execute when attacker obtains a mutex.

View Details

CVE-2002-1914

Program can not execute when attacker obtains a lock on a critical output file.

View Details

CVE-2002-1915

Program can not execute when attacker obtains a lock on a critical output file.

View Details

CVE-2002-0051

Critical file can be opened with exclusive read access by user, preventing application of security policy. Possibly related to improper permissions, large-window race condition.

View Details

CVE-2000-0338

Chain: predictable file names used for locking, allowing attacker to create the lock beforehand. Resultant from permissions and randomness.

View Details

CVE-2000-1198

Chain: Lock files with predictable names. Resultant from randomness.

View Details

CVE-2002-1869

Product does not check if it can write to a log file, allowing attackers to avoid logging by accessing the file using an exclusive lock. Overlaps unchecked error condition. This is not quite CWE-412, but close.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Verify controls for CWE-412 with SSDF evidence

Use NIST SSDF verification and vulnerability-response practices to detect CWE-412, Unrestricted Externally Accessible Lock, throughout the product lifecycle. Derive review questions, static or dynamic checks, and negative tests from the CWE's causal behavior; define the components and lifecycle stages each check covers; and retain findings with enough evidence to distinguish the root cause from symptoms and impacts. Track escapes and false negatives, then improve the verification plan after every confirmed occurrence.

NIST SP 800-218 Secure Software Development Framework — National Institute of Standards and Technology

Address Unrestricted Externally Accessible Lock during Architecture and Design

MITRE associates mitigation with Architecture and Design, and Implementation; documented detection approaches include White Box; recorded impacts include DoS: Resource Consumption (Other). Use these source-defined anchors to turn CWE-412 into implementation, review, and verification checks for the affected component.

CWE-412: Unrestricted Externally Accessible Lock — MITRE CWE

Triage CWE-412 against known exploitation evidence

Use CISA's Known Exploited Vulnerabilities catalog to test whether a vulnerability mapped to CWE-412, Unrestricted Externally Accessible Lock, has evidence of exploitation in the wild. Confirm the CVE-to-CWE root-cause mapping independently before attaching the example, then capture the affected product, required action, and remediation deadline. A missing KEV match is not evidence that the weakness is unexploited, and a KEV entry must not be generalized to every occurrence of this CWE.

Known Exploited Vulnerabilities Catalog — Cybersecurity and Infrastructure Security Agency

Apply precise root-cause mapping to CWE-412

Apply MITRE's full root-cause mapping guidance when using CWE-412, Unrestricted Externally Accessible Lock. Separate weakness language from attacker prerequisites and technical impact, check the entry's abstraction and vulnerability-mapping notes, and prefer the most specific Base or Variant supported by the evidence. Record the rejected alternatives and require an independent review before the mapping is used for remediation trends or program metrics.

CVE to CWE Root Cause Mapping Guidance — MITRE CWE

Validate CWE-412 with root-cause mapping checks

Apply MITRE's root-cause mapping quick tips to CWE-412, Unrestricted Externally Accessible Lock. Confirm the finding describes the causal weakness rather than an impact or attack pattern, compare the abstraction and mapping notes with plausible alternatives, and have a second reviewer challenge the selection. Preserve the evidence and reasoning so recurring defects can be measured against one consistent identifier.

CVE to CWE Root Cause Mapping Quick Tips — MITRE CWE

Frequently Asked Questions

What is CWE-412: Unrestricted Externally Accessible Lock?+

CWE-412: Unrestricted Externally Accessible Lock is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control. This prevents the product from acting on associated resources or performing other behaviors that are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex, or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite period of time, then the denial of service could be permanent.

What are the security consequences of Unrestricted Externally Accessible Lock?+

If exploited, CWE-412 (Unrestricted Externally Accessible Lock) it can compromise Availability, leading to outcomes such as DoS: Resource Consumption (Other).

How do you prevent or mitigate Unrestricted Externally Accessible Lock?+

Recommended mitigations for CWE-412 include: Use any access control that is offered by the functionality that is offering the lock. Use unpredictable names or identifiers for the locks. This might not always be possible or feasible. Consider modifying your code to use non-blocking synchronization methods.

How is Unrestricted Externally Accessible Lock detected?+

CWE-412 can be detected using White Box. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Unrestricted Externally Accessible Lock?+

CWE-412 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Unrestricted Externally Accessible Lock?+

MITRE documents real CVEs mapped to CWE-412, including CVE-2001-0682, CVE-2002-1914, CVE-2002-1915, CVE-2002-0051 and CVE-2000-0338. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-412 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-412: Unrestricted Externally Accessible Lock

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Phase

Description

Phase

Description

Phase

Description

Detection Methods

Method

Description

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (7)

CWE Relationships

Parent Weaknesses

Source-backed guidance

Verify controls for CWE-412 with SSDF evidence

Address Unrestricted Externally Accessible Lock during Architecture and Design

Triage CWE-412 against known exploitation evidence

Apply precise root-cause mapping to CWE-412

Validate CWE-412 with root-cause mapping checks

Frequently Asked Questions

Learn More