The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
View on MITRELocking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.
Inconsistent locking discipline can lead to deadlock.
Use industry standard APIs to implement locking mechanism.
No detection method information available for this CWE.
In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized.
This code tries to obtain a lock for a file, then writes to it.
PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock().
The following function attempts to acquire a lock in order to perform operations on a shared resource.
However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.
The following function attempts to acquire a lock in order to perform operations on a shared resource.
However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.
It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...
The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.
It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...
The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.
Chain: improper locking (CWE-667) leads to race condition (CWE-362), as exploited in the wild per CISA KEV.
View DetailsAttacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice
View Detailsfunction in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory.
View DetailsChain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.
View DetailsOS kernel performs an unlock in some incorrect circumstances, leading to panic.
View Detailschain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833).
View Detailsdeadlock when an operation is performed on a resource while it is being removed.
View DetailsDeadlock in device driver triggered by using file handle of a related device.
View DetailsDeadlock when large number of small messages cannot be processed quickly enough.
View DetailsProgram can not execute when attacker obtains a lock on a critical output file.
View DetailsProgram can not execute when attacker obtains a lock on a critical output file.
View DetailsCritical file can be opened with exclusive read access by user, preventing application of security policy. Possibly related to improper permissions, large-window race condition.
View DetailsChain: predictable file names used for locking, allowing attacker to create the lock beforehand. Resultant from permissions and randomness.
View DetailsProduct does not check if it can write to a log file, allowing attackers to avoid logging by accessing the file using an exclusive lock. Overlaps unchecked error condition. This is not quite CWE-412, but close.
View DetailsNo relationship information available for this CWE.
CWE-667: Improper Locking is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.
If exploited, CWE-667 (Improper Locking) it can compromise Availability, leading to outcomes such as DoS: Resource Consumption (CPU).
Recommended mitigations for CWE-667 include: Use industry standard APIs to implement locking mechanism.
MITRE documents real CVEs mapped to CWE-667, including CVE-2021-1782, CVE-2009-0935, CVE-2010-4210, CVE-2008-4302 and CVE-2009-1243. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-667 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.