CWEweakness
CWE-662 Improper Synchronization
- Abstraction
- Class
- Structure
- Simple
- Status
- Draft
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
Extended description
Synchronization mechanisms vary widely, but they may include locking, mutexes, and semaphores.
Common consequences
• Integrity, Confidentiality, Other: Modify Application Data, Modify Memory, Read Application Data, Alter Execution Logic — Improper synchronization could lead to data or memory corruption.
• Availability: DoS: Crash, Exit, or Restart, DoS: Instability — Improper synchronization could lead to data or memory corruption, denial of service, etc.
Potential mitigations
• [Implementation] Use industry standard APIs to synchronize your code.
Detection methods
• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Observed examples
• CVE-2021-1782: Chain: improper locking (CWE-667) leads to race condition (CWE-362), as exploited in the wild per CISA KEV.
• CVE-2009-0935: Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice
Related
Attack pattern · CAPEC (4)
Observed example · CVE (2)
- CVE-2021-1782 A race condition was addressed with improved locking. vulnerability
- CVE-2009-0935 The inotify_read function in the Linux kernel 2.6.27 to 2.6.27.13, 2.6.28 to 2.6.28.2, and 2.6.29-rc3 allows local users to cause a denial… vulnerability
Can precede · CWE (1)
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
Child of · CWE (2)
Referenced by CAPEC · weakness (4)
Referenced by CVE · weakness (73)
- CVE-2026-72057 In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation… vulnerability
- CVE-2026-68103 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When… vulnerability
- CVE-2026-68149 In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() The… vulnerability
- CVE-2026-68404 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect… vulnerability
- CVE-2026-64556 In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec… vulnerability
- CVE-2026-64312 In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt… vulnerability
- CVE-2026-63832 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since… vulnerability
- CVE-2026-64005 In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables… vulnerability
- CVE-2026-13489 A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. vulnerability
- CVE-2026-53277 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection… vulnerability
- CVE-2026-43362 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2_write()… vulnerability
- CVE-2026-43466 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX… vulnerability
- CVE-2026-31479 In the Linux kernel, the following vulnerability has been resolved: drm/xe: always keep track of remap prev/next During 3D workload, user… vulnerability
- CVE-2026-39865 Axios is a promise based HTTP client for the browser and Node.js. vulnerability
- CVE-2026-23437 In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a… vulnerability
- CVE-2026-28789 OliveTin gives access to predefined shell commands from a web interface. vulnerability
- CVE-2025-68775 In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a… vulnerability
- CVE-2025-22853 Improper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege… vulnerability
- CVE-2024-58131 FISCO BCOS 3.11.0 has an issue with synchronization of the transaction pool that can, for example, be observed when a malicious node (that… vulnerability
- CVE-2025-27104 vyper is a Pythonic Smart Contract Language for the EVM. vulnerability
- CVE-2024-7409 A flaw was found in the QEMU NBD Server. vulnerability
- CVE-2024-32644 Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. vulnerability
- CVE-2024-30387 A Missing Synchronization vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on ACX5448 and ACX710 allows an… vulnerability
- CVE-2021-46939 In the Linux kernel, the following vulnerability has been resolved: tracing: Restructure trace_clock_global() to never block It was… vulnerability
- CVE-2023-45084 An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to… vulnerability
- CVE-2023-5088 A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead… vulnerability
- CVE-2023-2801 Grafana is an open-source platform for monitoring and observability. vulnerability
- CVE-2023-20625 In adsp, there is a possible double free due to a race condition. vulnerability
- CVE-2022-32642 In ccd, there is a possible memory corruption due to a race condition. vulnerability
- CVE-2022-32643 In ccd, there is a possible use after free due to a race condition. vulnerability
Referenced by CWE · child of (13)
- CWE-1058 Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element weakness
- CWE-1096 Singleton Class Instance Creation without Proper Locking or Synchronization weakness
- CWE-1265 Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls weakness
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
- CWE-366 Race Condition within a Thread weakness
- CWE-543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context weakness
- CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context weakness
- CWE-663 Use of a Non-reentrant Function in a Concurrent Context weakness
- CWE-667 Improper Locking weakness
- CWE-764 Multiple Locks of a Critical Resource weakness
- CWE-820 Missing Synchronization weakness
- CWE-821 Incorrect Synchronization weakness
- CWE-833 Deadlock weakness