Missing Lock Check

Draft Base
Structure: Simple
Description

This vulnerability occurs when software fails to verify that a proper synchronization lock is active before accessing or modifying a shared resource, potentially leading to race conditions and data corruption.

Extended Description

In concurrent programming, multiple threads or processes often need to share access to the same data or system resource, such as a variable, file, or database entry. A missing lock check happens when a developer assumes a lock is already held or forgets to implement the verification step entirely. The code proceeds with a sensitive operation—like writing to a shared buffer or updating a configuration—without first confirming the necessary mutual exclusion lock is in place. This oversight breaks the intended synchronization, allowing other threads to interfere during the critical operation. The consequence is typically a race condition, where the final state of the resource depends on the unpredictable timing of thread execution. This can manifest as corrupted data, inconsistent application state, crashes, or security bypasses if the resource controls access permissions. To prevent this, developers must explicitly validate lock ownership at the entry point of any critical section. Using established synchronization primitives correctly and adopting thread-safe design patterns are essential to ensure that only one thread can modify the resource at a time.

Common Consequences 1
Scope: IntegrityAvailability

Impact: Modify Application DataDoS: InstabilityDoS: Crash, Exit, or Restart

Potential Mitigations 1
Phase: Architecture and DesignImplementation
Implement a reliable lock mechanism.
Observed Examples 1
CVE-2004-1056Product does not properly check if a lock is present, allowing other attackers to access functionality.
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Architecture and Design
Implementation
Related Weaknesses
Taxonomy Mapping
  • PLOVER
  • Software Fault Patterns