Improper Locking
CWE-667
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
We track 89 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.9. 2 have been exploited in real attacks.
How this weakness is prevented
- Implementation: Use industry standard APIs to implement locking mechanism.
Latest Improper Locking vulnerabilities
- 7.5 High severity
OpenSSL: Improper Locking
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process h
- 7.0 High severity
Android: Improper Locking
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
- 7.0 High severity
Linux kernel: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak
- 7.0 High severity
kernel: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within the handling of pipe buffers. The issue results from the lack of proper locking when performing operations on an object. T
- 7.8 High severity
macOS: Improper Locking
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina. An app may be able to execute arbitrary code with kernel privileges.
- 7.5 High severity
Mitsubishi Electric MELSEC iQ-R Series…: Improper Locking
Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi Electric MELSEC-Q Series Q03UDECPU the first 5 digits of serial No. "24061" and prior, Mitsubishi Electric MELSEC-Q Series
- 7.0 High severity
Android: Concurrent Execution using Shared Resource with Improper Synchronization
In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local escalation of privilege when opening and closing inet sockets with no additional execution privileges needed. User interaction is not needed for
- 7.5 High severity
Junos OS: Improper Locking
An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated networked attacker to cause a flowprocessing daemon (flowd) crash and thereby a Denial of Service (DoS). Continued receipt of th
- 7.0 High severity
Apple Multiple Products Race Condition Exploited
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, watchOS 7.3, tvOS 14.4, iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevat