CWE-413: Improper Resource Locking
Description
The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.
When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the product. This might violate the product's assumption that the resource will not change, potentially leading to unexpected behaviors.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- IntegrityAvailability
Modify Application Data; DoS: Instability; DoS: Crash, Exit, or Restart
Potential mitigations
- Architecture and Design
Use a non-conflicting privilege scheme.
- Architecture and DesignImplementation
Use synchronization when locking a resource.
Related weaknesses
Parent weaknesses
Child weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.