CWE-413: Improper Resource Locking
View customized information:
When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the software. This might violate the software's assumption that the resource will not change, potentially leading to unexpected behaviors.
![]() ![]()
![]() ![]()
![]()
![]() 语言 班级: Not Language-Specific(不确定的患病率) ![]()
Example 1 以下功能试图获取锁定以在共享资源上执行操作。
(bad code)
Example Language:C
void f(pthread_mutex_t *mutex) {
pthread_mutex_lock(mutex);
/* access shared resource */ pthread_mutex_unlock(mutex); However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior. 为了避免数据竞赛,正确编写的程序必须检查线程同步函数的结果,并通过尝试从它们恢复或将其报告到更高级别来适当处理所有错误。
(good code)
Example Language:C
int f(pthread_mutex_t *mutex) {
int result;
result = pthread_mutex_lock(mutex); if (0 != result)
返回结果;
/* access shared resource */ 返回pthread_mutex_unlock(mutex); Example 2 This Java example shows a simple BankAccount class with deposit and withdraw methods.
(bad code)
Example Language:爪哇
公共类BankAccount {
// variable for bank account balance 私人双重帐户; // constructor for BankAccount public BankAccount() {
accountBalance = 0; }//将金额存入银行估计的方法 public void deposit(double depositAmount) { 双重新空白=帐户余额 + redageAmount; 帐户余额= newbalance; //从BankAccount提取金额的方法 公共无效提取(双重提取){ 双重新空白=帐户余额 - 取款; 帐户余额= newbalance; // other methods for accessing the BankAccount object ... However, the deposit and withdraw methods have shared access to the account balance private class variable. This can result in a race condition if multiple threads attempt to call the deposit and withdraw methods simultaneously where the account balance is modified by one thread before another thread has completed modifying the account balance. For example, if a thread attempts to withdraw funds using the withdraw method before another thread that is depositing funds using the deposit method completes the deposit then there may not be sufficient funds for the withdraw transaction. To prevent multiple threads from having simultaneous access to the account balance variable the deposit and withdraw methods should be synchronized using the synchronized modifier.
(good code)
Example Language:爪哇
公共类BankAccount {
...
// synchronized method to deposit amount into BankAccount public synchronized void deposit(double depositAmount) {
... }// synchronized method to withdraw amount from BankAccount public synchronized void withdraw(double withdrawAmount) {
... }... 另一种解决方案是使用锁定对象来确保对银行帐户余额变量的独家访问。如下所示,存款和提取方法使用锁定对象设置锁定,以阻止其他线程对bankAccount对象的访问,直到该方法完成更新银行帐户余额变量为止。
(good code)
Example Language:爪哇
公共类BankAccount {
...
//锁定线程访问方法的对象 私人重新进入Balancechangelock; //条件对象暂时将锁定到其他线程 私人条件足够的范围; //将金额存入银行估计的方法 公共无效存款(双重金额){ //将锁定锁定以阻止从其他线程访问bankAccount balanceChangeLock.lock(); 尝试 {
双重新空白=余额 +金额;
balance = newBalance; // inform other threads that funds are available sufficientFundsCondition.signalAll(); 最后 {
//解锁锁定对象 }balanceChangeLock.unlock(); //从银行帐户提取金额的方法 public void withdraw(double amount) { //将锁定锁定以阻止从其他线程访问bankAccount balanceChangeLock.lock(); 尝试 {
while(余额<量){
// temporarily unblock access //直到有足够的资金可用 AfficeFundScondition.await(); 双重新空白=余额 - 金额; balance = newBalance; 最后 {
//解锁锁定对象 }balanceChangeLock.unlock(); ... ![]()
More information is available — Please select a different filter.
|
Use of the Common Weakness Enumeration (CWE) and the associated references from this website are subject to the使用条款. CWE is sponsored by theU.S. Department of Homeland Security(DHS)网络安全和基础设施安全局(CISA),由家land Security Systems Engineering and Development Institute(HSSEDI)由manbetx客户端首页(MITRE). Copyright © 2006–2023, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. |