CWE-667: Improper Locking

Description:
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Extended Description:
Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process.  This can lead to data or memory corruption, denial of service, etc.

Affected languages: Not Language-Specific
Affected technologies: Not Technology-Specific
Parent weaknesses: CWE-662, CWE-662, CWE-662, CWE-662

Consequences:
  - Availability: DoS: Resource Consumption (CPU)

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Implementation] Use industry standard APIs to implement locking mechanism.

Demonstrative examples:
In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized.

private long someLongValue; public long getLongValue() { return someLongValue; } 
                      public void setLongValue(long l) { someLongValue = l; }

This code tries to obtain a lock for a file, then writes to it.
PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock().
function writeToLog($message){ $logfile = fopen("logFile.log", "a"); 
                         //attempt to get logfile lock 
                         if (flock($logfile, LOCK_EX)) { fwrite($logfile,$message); 
                            // unlock logfile 
                            flock($logfile, LOCK_UN); } e

Real-world examples:
  - CVE-2021-1782: Chain: improper locking (CWE-667) leads to race condition (CWE-362), as exploited in the wild per CISA KEV.
  - CVE-2009-0935: Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice
  - CVE-2010-4210: function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory.
  - CVE-2008-4302: Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.
  - CVE-2009-1243: OS kernel performs an unlock in some incorrect circumstances, leading to panic.