CWE-667: Improper Locking

ID CWE-667

Abstraction Class

Structure Simple

Status Draft

Number of CVEs 237

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Locking is a type of synchronization behavior that ensures that multiple independently-operating processes or threads do not interfere with each other when accessing the same resource. All processes/threads are expected to follow the same steps for locking. If these steps are not followed precisely - or if no locking is done at all - then another process/thread could modify the shared resource in a way that is not visible or predictable to the original process. This can lead to data or memory corruption, denial of service, etc.

Modes of Introduction

Phase	Note
Architecture and Design
Implementation

Relationships

View			Weakness
# ID	View	Status	# ID	Name	Abstraction	Structure	Status
CWE-1000	Research Concepts	Draft	CWE-662	Improper Synchronization	Class	Simple	Draft
CWE-1003	Weaknesses for Simplified Mapping of Published Vulnerabilities	Incomplete	CWE-662	Improper Synchronization	Class	Simple	Draft
CWE-1305	CISQ Quality Measures (2020)	Incomplete	CWE-662	Improper Synchronization	Class	Simple	Draft
CWE-1340	CISQ Data Protection Measures	Incomplete	CWE-662	Improper Synchronization	Class	Simple	Draft

Common Attack Pattern Enumeration and Classification (CAPEC)

The Common Attack Pattern Enumeration and Classification (CAPEC™) effort provides a publicly available catalog of common attack patterns that helps users understand how adversaries exploit weaknesses in applications and other cyber-enabled capabilities.

CAPEC at Mitre.org

# ID	Name	Weaknesses
CAPEC-25	Forced Deadlock	CWE-667
CAPEC-26	Leveraging Race Conditions	CWE-667
CAPEC-27	Leveraging Race Conditions via Symbolic Links	CWE-667

CVEs Published

Based on CVE published date

CVSS Severity

CVSS Severity - By Year

CVSS Base Score

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date