Use of Singleton Pattern Without Synchronization in a Multithreaded Context

Opis

The product uses the singleton pattern when creating a resource within a multithreaded environment.

The use of a singleton pattern may not be thread-safe.

Skutki

• Other, Integrity

  Other; Modify Application Data

Zapobieganie

• Architecture and Design

  Use the Thread-Specific Storage Pattern. See References.

• Implementation

  Do not use member fields to store information in the Servlet. In multithreading environments, storing user data in Servlet member fields introduces a data access race condition.

• Implementation

  Avoid using the double-checked locking pattern in language versions that cannot guarantee thread safety. This pattern may be used to avoid the overhead of a synchronized call, but in certain versions of Java (for example), this has been shown to be unsafe because it still introduces a race condition (CWE-209).

  Skuteczność: Limited

Słabość nadrzędna

• CWE-820 Missing Synchronization
• CWE-662 Improper Synchronization

Kiedy powstaje

• Implementation

Dotyczy

Java, C++

Źródła

1. Thread-Specifc Storage for C/C++ — Douglas C. Schmidt, Timothy H. Harrison, Nat Pryce