Skip to content
OpenAdvisories

Weakness (CWE)

CWE-412: Unrestricted Externally Accessible Lock

Base Incomplete

The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control.

More detail

This prevents the product from acting on associated resources or performing other behaviors that are controlled by the presence of the lock. Relevant locks might include an exclusive lock or mutex, or modifying a shared resource that is treated as a lock. If the lock can be held for an indefinite period of time, then the denial of service could be permanent.

How to prevent it (3 mitigations)

  1. Architecture and Design, Implementation

    Use any access control that is offered by the functionality that is offering the lock.

  2. Architecture and Design, Implementation

    Use unpredictable names or identifiers for the locks. This might not always be possible or feasible.

  3. Architecture and Design

    Consider modifying your code to use non-blocking synchronization methods.

Source: MITRE CWE-412

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 1.8
    CVE-2026-82312

    OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial…

    OpenVPN OpenVPN
  • Low 3.3
    CVE-2019-11485

    apport created lock file in wrong directory

    Sander Bos discovered Apport's lock file was in a world-writable directory which allowed all users to prevent crash handling.

    Canonical Apport apport Ubuntu