CWE-667: Improper Locking

参考: CVE-2021-1782

Chain: improper locking (CWE-667) leads to race condition (CWE-362), as exploited in the wild per CISA KEV.

参考: CVE-2009-0935

Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice

参考: CVE-2010-4210

function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory.

参考: CVE-2008-4302

Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.

参考: CVE-2009-1243

OS kernel performs an unlock in some incorrect circumstances, leading to panic.

参考: CVE-2009-2857

OS deadlock

参考: CVE-2009-1961

OS deadlock involving 3 separate functions

参考: CVE-2009-2699

deadlock in library

参考: CVE-2009-4272

deadlock triggered by packets that force collisions in a routing table

参考: CVE-2002-1850

read/write deadlock between web server and script

参考: CVE-2004-0174

web server deadlock involving multiple listening connections

参考: CVE-2009-1388

multiple simultaneous calls to the same function trigger deadlock.

参考: CVE-2006-5158

chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833).

参考: CVE-2006-4342

deadlock when an operation is performed on a resource while it is being removed.

参考: CVE-2006-2374

Deadlock in device driver triggered by using file handle of a related device.

参考: CVE-2006-2275

Deadlock when large number of small messages cannot be processed quickly enough.

参考: CVE-2005-3847

OS kernel has deadlock triggered by a signal during a core dump.

参考: CVE-2005-3106

Race condition leads to deadlock.

参考: CVE-2005-2456

Chain: array index error (CWE-129) leads to deadlock (CWE-833)

参考: CVE-2001-0682

Program can not execute when attacker obtains a mutex.

参考: CVE-2002-1914

Program can not execute when attacker obtains a lock on a critical output file.

参考: CVE-2002-1915

Program can not execute when attacker obtains a lock on a critical output file.

参考: CVE-2002-0051

Critical file can be opened with exclusive read access by user, preventing application of security policy. Possibly related to improper permissions, large-window race condition.

参考: CVE-2000-0338

Chain: predictable file names used for locking, allowing attacker to create the lock beforehand. Resultant from permissions and randomness.

参考: CVE-2000-1198

Chain: Lock files with predictable names. Resultant from randomness.

参考: CVE-2002-1869

Product does not check if it can write to a log file, allowing attackers to avoid logging by accessing the file using an exclusive lock. Overlaps unchecked error condition. This is not quite CWE-412, but close.