CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.1)  
Search by ID:

CWE-667: Insufficient Locking

Individual Definition in a New Window
Insufficient Locking
Status: Draft
Weakness ID: 667 (Weakness Base)
Description
Summary

The software does not properly acquire a lock on a resource, leading to unexpected resource state changes and behaviors.

Potential Mitigations

Use industry standard APIs to implement locking mechanism.

Demonstrative Examples

In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized.

Java Example:
private long someLongValue;
public long getLongValue() {
return someLongValue;
}
 
public void setLongValue(long l) {
someLongValue = l;
}
Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness BaseWeakness BaseWeakness Base662Insufficient Synchronization
Development Concepts (primary)699
Research Concepts (primary)1000
ChildOfWeakness ClassWeakness ClassWeakness Class664Insufficient Control of a Resource Through its Lifetime
Research Concepts1000
ChildOfCategoryCategory748CERT C Secure Coding Section 50 - POSIX (POS)
Weaknesses Addressed by the CERT C Secure Coding Standard (primary)734
ParentOfWeakness BaseWeakness BaseWeakness Base412Unrestricted Lock on Critical Resource
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base413Insufficient Resource Locking
Research Concepts (primary)1000
ParentOfWeakness BaseWeakness BaseWeakness Base414Missing Lock Check
Research Concepts (primary)1000
Taxonomy Mappings
Mapped Taxonomy NameNode IDMapped Node Name
CERT C Secure CodingPOS31-CDo not unlock or destroy another thread's mutex
Time of Introduction
* Architecture and Design
* Implementation
Content History
Modifications
Sean Eidemiller. Cigital. 2008-07-01. (External)
added/updated demonstrative examples
Eric Dalci. Cigital. 2008-07-01. (External)
updated Potential_Mitigations, Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Relationships
CWE Content Team. MITRE. 2008-11-24. (Internal)
updated Relationships, Taxonomy_Mappings
Page Last Updated: November 24, 2008