CWE-413 — Improper Resource Locking
CWE-413: Improper Resource Locking
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the product. This might violate the product's assumption that the resource will not change, potentially leading to unexpected behaviors.
Common consequences
- Integrity, Availability: Modify Application Data, DoS: Instability, DoS: Crash, Exit, or Restart
Mitigations
Architecture and Design — Use a non-conflicting privilege scheme.
Architecture and Design — Use synchronization when locking a resource.
References
- CWE page: https://cwe.mitre.org/data/definitions/413.html
- CWE list: https://cwe.mitre.org/data/index.html