CWE-667: Improper Locking, page 13
Filter
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
What the weakness is: CWE-667 at MITRE. All weaknesses
Related attack patterns (CAPEC): 3
- CAPEC-25 Forced Deadlock Likelihood: Low · Severity: High
- CAPEC-26 Leveraging Race Conditions Likelihood: High · Severity: High
- CAPEC-27 Leveraging Race Conditions via Symbolic Links Likelihood: Medium · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-667, as MITRE names them. Credits.
Ask an AI about CWE-667
Show the prompt
Explain CWE-667: Improper Locking and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/667.html and https://cve.bz/cve/cwe/667?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.8CVE-2023-44298EPSS 0.2%
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information …
- 6.8CVE-2023-44297EPSS 0.3%
Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. An unauthenticated physical attacker could potentially exploit this vulnerability, leading to information …
- 7.8CVE-2023-3889EPSS 0.2%
A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.
- 7.8CVE-2023-3781EPSS 0.08%
there is a possible use-after-free write due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.5CVE-2023-44119EPSS 0.4%
Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.
- 5.3CVE-2023-42441EPSS 0.5%
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at run…
- 7.5CVE-2023-38505EPSS 0.8%
DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be w…
- 5.3CVE-2023-3750EPSS 0.8%
A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue co…
- 5.3CVE-2023-33951EPSS 0.3%
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a loca…
- 8.1CVE-2023-32258EPSS 2.5%
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing…
- 8.1CVE-2023-32257EPSS 2.4%
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when pe…
- 5.5CVE-2023-2430EPSS 0.2%
A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. This flaw allows a local attacker with user privilege to trigger a Denial of Service threat.
- 5.5CVE-2023-0160EPSS 0.3%
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
- 6.7CVE-2023-21400EPSS 0.3%
In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not nee…
- 7.3CVE-2023-21189EPSS 0.09%
In startLockTaskMode of LockTaskController.java, there is a possible bypass of lock task mode due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
- 3.3CVE-2023-3436EPSS 0.2%
Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is itself in another object stream.
- 7.8CVE-2023-21120EPSS 0.07%
In multiple functions of cdm_engine.cpp, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploi…
- 6.7CVE-2023-20746EPSS 0.07%
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Iss…
- 6.7CVE-2023-20745EPSS 0.07%
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Iss…
- 6.7CVE-2023-20743EPSS 0.07%
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519142; Iss…
- 6.7CVE-2023-20737EPSS 0.07%
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID…
- 6.7CVE-2023-20733EPSS 0.07%
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID…
- 4.7CVE-2023-2612EPSS 0.3%
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadloc…
- 7.5CVE-2023-22318EPSS 0.5%
Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5.
- 4.4CVE-2023-2269EPSS 0.2%
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dm-ioctl.c in the Linux Kernel Device Mapper-Multipathing sub-component.
- 7.8CVE-2023-2007EPSS 0.3%
The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate p…
- 7.8CVE-2023-21000EPSS 0.08%
In MediaCodec.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: Androi…
- 7.8CVE-2023-20939EPSS 0.07%
In multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
- 6.7CVE-2023-20619EPSS 0.08%
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519159; Issue…
- 6.7CVE-2023-20618EPSS 0.08%
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07519184; Issue…
- 7.8CVE-2023-20928EPSS 0.2%
In binder_vma_close of binder.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.P…
- 7.5CVE-2023-22412EPSS 0.5%
An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC or MS-MIC card and SRX Series allows an unauthenticated, network-based attacker to cause a flow processing daemon (flowd) crash and ther…
- 7.5CVE-2022-48216EPSS 0.8%
Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.
- 5.5CVE-2021-43395EPSS 0.3%
An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 2021.04, and SmartOS 20210923. A local unprivileged user can cause a deadlock and kernel panic via cr…
- 7.8CVE-2022-20566EPSS 0.2%
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.P…
- 7.5CVE-2022-3996EPSS 1.3%
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when …
- 5.5CVE-2022-42329EPSS 0.2%
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might…
- 5.5CVE-2022-42328EPSS 0.2%
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The patch for XSA-392 introduced another issue which might…
- 5.5CVE-2022-42775EPSS 0.10%
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
- 5.5CVE-2022-39131EPSS 0.10%
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
- 5.5CVE-2022-4129EPSS 0.2%
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system…
- 6.5CVE-2022-39358EPSS 0.5%
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a m…
- 5.5CVE-2022-38690EPSS 0.1%
In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
- 7.0CVE-2022-20422EPSS 0.2%
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne…
- 6.7CVE-2022-26473EPSS 0.1%
In vdec fmt, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07342197; Iss…
- 6.7CVE-2022-26452EPSS 0.08%
In isp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07262305; Issue ID…
- 4.7CVE-2022-3303EPSS 0.3%
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) …
- 6.7CVE-2022-26451EPSS 0.08%
In ged, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07202966; Issue ID…
- 7.0CVE-2022-3028EPSS 0.2%
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of…
- 5.5CVE-2022-38791EPSS 0.3%
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.