The software does not lock or does not correctly lock a resource when the software must have exclusive access to the resource.
Extended Description
When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the software. This might violate the software's assumption that the resource will not change, potentially leading to unexpectedbehaviors.
The following function attempts to acquire a lock in order to
perform operations on a shared resource.
(Bad Code)
Example
Language: C
void f(pthread_mutex_t *mutex) {
pthread_mutex_lock(mutex);
/* access shared resource */
pthread_mutex_unlock(mutex);
}
However, the code does not check the value returned by
pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire
the mutex for any reason the function may introduce a race condition
into the program and result in undefined behavior.
In order to avoid data races correctly written programs must check the
result of thread synchronization functions and appropriately handle all
errors, either by attempting to recover from them or reporting it to
higher levels.
Description
