CWE-543 — Use of Singleton Pattern Without Synchronization in a Multithreaded Context
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Incomplete |
| Likelihood of exploit | — |
Description
The product uses the singleton pattern when creating a resource within a multithreaded environment.
The use of a singleton pattern may not be thread-safe.
Common consequences
- Other, Integrity: Other, Modify Application Data
Mitigations
Architecture and Design — Use the Thread-Specific Storage Pattern. See References.
Implementation — Do not use member fields to store information in the Servlet. In multithreading environments, storing user data in Servlet member fields introduces a data access race condition.
Implementation — Avoid using the double-checked locking pattern in language versions that cannot guarantee thread safety. This pattern may be used to avoid the overhead of a synchronized call, but in certain versions of Java (for example), this has been shown to be unsafe because it still introduces a race condition (CWE-209).
References
- CWE page: https://cwe.mitre.org/data/definitions/543.html
- CWE list: https://cwe.mitre.org/data/index.html