Book a Security Review

Weakness · Medium

CWE-412: Unrestricted Externally Accessible Lock

What it is

The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

MITRE CWE 4.19.1

Severity (our rating)
Medium
Likelihood of exploit
Not rated by MITRE
Introduced during
Architecture and Design, Implementation
Exploited in the wild
No CVE in CISA's catalog

In more detail

This prevents the product from acting on associated resources or performing other behaviors that are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex, or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite period of time, then the denial of service could be permanent.

What an attacker can do

  • DoS: Resource Consumption (Other) (Availability)

How to prevent it

Architecture and Design

  • Use any access control that is offered by the functionality that is offering the lock.
  • Use unpredictable names or identifiers for the locks. This might not always be possible or feasible.
  • Consider modifying your code to use non-blocking synchronization methods.

How to find it

  • White Box. Automated code analysis techniques might not be able to reliably detect this weakness, since the application's behavior and general security model dictate which resource locks are critical. Interpretation of the weakness might require knowledge of the environment, e.g. if the existence of a file is used as a lock, but the file is created in a world-writable directory.

CWE-412 on MITRE's CWE site

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.