CWEweakness

CWE-413 Improper Resource Locking

Official page ↗
Abstraction
Base
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product must have exclusive access to a resource, but it does not lock or does not correctly lock that resource.

Common consequences

• Integrity, Availability: Modify Application Data, DoS: Instability, DoS: Crash, Exit, or Restart — When a resource is not properly locked, an attacker could modify the resource while it is being operated on by the product. This might violate the product's assumption that the resource will not change, potentially leading to unexpected behaviors.

Potential mitigations

• [Architecture and Design] Use a non-conflicting privilege scheme. • [Architecture and Design, Implementation] Use synchronization when locking a resource.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2022-20141: Chain: an operating system kernel has insufficient resource locking (CWE-413) leading to a use after free (CWE-416).

Related

Observed example · CVE (1)

  • CVE-2022-20141 In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. vulnerability

Child of · CWE (1)

  • CWE-667 Improper Locking weakness

Referenced by CVE · weakness (19)

  • CVE-2026-102080 An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows… vulnerability
  • CVE-2026-102083 An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated,… vulnerability
  • CVE-2026-105390 Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local… vulnerability
  • CVE-2026-92615 A flaw was found in flightctl. vulnerability
  • CVE-2026-44608 NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met… vulnerability
  • CVE-2026-32748 Squid is a caching proxy for the Web. vulnerability
  • CVE-2025-69198 Pterodactyl is a free, open-source game server management panel. vulnerability
  • CVE-2025-0003 Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in… vulnerability
  • CVE-2025-3450 An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an… vulnerability
  • CVE-2023-32253 A flaw was found in the Linux kernel's ksmbd component. vulnerability
  • CVE-2022-49737 In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various… vulnerability
  • CVE-2023-33951 A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. vulnerability
  • CVE-2023-2430 A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kernel. vulnerability
  • CVE-2023-28649 The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. vulnerability
  • CVE-2023-2269 A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in… vulnerability
  • CVE-2022-24946 Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and prior, Mitsubishi… vulnerability
  • CVE-2022-20678 A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected… vulnerability
  • CVE-2019-17102 An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. vulnerability
  • CVE-2019-8998 An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the /proc filesystem)… vulnerability

Referenced by CWE · child of (1)

  • CWE-591 Sensitive Data Storage in Improperly Locked Memory weakness