Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-412 (未加限制的外部可访问锁) — Vulnerability Class 4

4 vulnerabilities classified as CWE-412 (未加限制的外部可访问锁). AI Chinese analysis included.

CWE-412 represents a concurrency weakness where a synchronization mechanism, such as a mutex or exclusive lock, is improperly exposed to external actors. This vulnerability arises when the product validates the lock’s existence but fails to restrict who can manipulate its state, allowing unauthorized users to influence the locking logic. Attackers typically exploit this by acquiring or releasing the lock maliciously, causing denial of service through resource starvation or inducing race conditions that compromise data integrity. To prevent this, developers must enforce strict access controls on synchronization primitives, ensuring that only trusted, internal application components can acquire or modify locks. By isolating these critical resources from external input and validating the caller’s identity before granting lock access, engineers can maintain system stability and protect shared resources from unauthorized interference.

MITRE CWE Description
The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control. This prevents the product from acting on associated resources or performing other behaviors that are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex, or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite period of time, then the denial of service could be permanent.
Common Consequences (1)
AvailabilityDoS: Resource Consumption (Other)
When an attacker can control a lock, the program may wait indefinitely until the attacker releases the lock, causing a denial of service to other users of the program. This is especially problematic if there is a blocking operation on the lock.
Mitigations (3)
Architecture and Design, ImplementationUse any access control that is offered by the functionality that is offering the lock.
Architecture and Design, ImplementationUse unpredictable names or identifiers for the locks. This might not always be possible or feasible.
Architecture and DesignConsider modifying your code to use non-blocking synchronization methods.
Examples (1)
This code tries to obtain a lock for a file, then writes to it.
function writeToLog($message){ $logfile = fopen("logFile.log", "a"); //attempt to get logfile lock if (flock($logfile, LOCK_EX)) { fwrite($logfile,$message); // unlock logfile flock($logfile, LOCK_UN); } else { print "Could not obtain lock on logFile.log, message not recorded\n"; } } fclose($logFile);
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2026-25612 Internal ResourceId collision may affect unrelated collections — MongoDB Server 6.5 Medium2026-02-10
CVE-2023-22318 Denial of service against webconf — Checkmk Appliance 7.5 High2023-05-15
CVE-2019-11485 apport created lock file in wrong directory — apport 3.3 Low2020-02-08
CVE-2019-18269 Omron PLC CJ series安全漏洞 — Omron PLC CJ Series 9.8 -2019-12-16

Vulnerabilities classified as CWE-412 (未加限制的外部可访问锁) represent 4 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.