Improper Resource Locking

Opis

The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.

When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the product. This might violate the product's assumption that the resource will not change, potentially leading to unexpected behaviors.

Skutki

• Integrity, Availability

  Modify Application Data; DoS: Instability; DoS: Crash, Exit, or Restart

Zapobieganie

• Architecture and Design

  Use a non-conflicting privilege scheme.

• Architecture and Design, Implementation

  Use synchronization when locking a resource.

Przykłady podatności

• CVE-2022-20141 Chain: an operating system kernel has insufficent resource locking (CWE-413) leading to a use after free (CWE-416).

Słabość nadrzędna

• CWE-667 Improper Locking

Słabości podrzędne

• CWE-591 Sensitive Data Storage in Improperly Locked Memory

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific