Weakness (CWE)
CWE-413: Improper Resource Locking
The product must have exclusive access to a resource, but it does not lock or does not correctly lock that resource.
How to prevent it (2 mitigations)
-
Architecture and Design
Use a non-conflicting privilege scheme.
-
Architecture and Design, Implementation
Use synchronization when locking a resource.
Source: MITRE CWE-413
21 results · Feed
-
Unscored —
Out of bound access in PPC due to race condition in global variable access
-
Medium 4.7
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged …
-
Medium 5.3
Junos OS: MX Series: Malformed SyncE or PTP clock input causes continuous RE switchover
An Improper Resource Locking vulnerability in the clock synchronization daemon (clksyncd) of Juniper Networks Junos OS on MX Series allows a unauthenticated, logically adjacent attacker to cause a Denial-of-Service (DoS). If a SyncE or PTP upstream node sends…
-
Medium 5.9
Junos OS: SRX Series: With WebFiltering enabled prolonged HTTP session load can cause a crash
An Improper Resource Locking vulnerability in the UTM processing of Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). When UTM WebFiltering is configured and the WebFiltering cloud se…
-
Medium 6.9
Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 a…
-
Medium 6.6
Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tenant tls-config bleed
A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify, a custom CA bundle, or tenant-supplied mTLS client certificates) and installs it into …
-
Medium 4.6
Use after free and crash under special conditions in RPZ code
NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency vulnerability that when certain conditions are met (multi-threaded, RPZ XFR reload, RPZ zone with 'rpz-nsip'/'rpz-nsdname' triggers) it could result in heap use-after-fre…
-
High 8.7
Squid has Denial of Service in ICP Response handling
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker t…
-
Medium 6.0
Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits…
-
High 7.3
Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition pote…
-
Critical 10.0
Automation Runtime SDM requests may impact system
An Improper Resource Locking vulnerability in the SDM component of B&R Automation Runtime versions before 6.3 and before Q4.93 may allow an unauthenticated network-based attacker to delete data causing denial of service conditions.
-
Medium 5.9
Kernel: deadlock in ksmbd_find_crypto_ctx()
A flaw was found in the Linux kernel's ksmbd component. A deadlock is triggered by sending multiple concurrent session setup requests, possibly leading to a denial of service.
-
High 7.7
In X.Org X server 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread …
-
Medium 6.7
Kernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to…
-
Medium 5.5
A vulnerability was found due to missing lock for IOPOLL flaw in io_cqring_event_overflow() in io_uring.c in Linux Kern…
-
High 8.6
The Hub in the Snap One OvrC cloud platform is a device used to centralize and manage nested devices connected to it. A…
-
Unscored —
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_c…
-
High 7.5
Improper Resource Locking vulnerability in Mitsubishi Electric MELSEC iQ-R Series R12CCPU-V firmware versions "16" and …
-
High 8.6
Cisco IOS XE Software AppNav-XE Denial of Service Vulnerability
A vulnerability in the AppNav-XE feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS) condition. This vulnerability is due to the incorrect handling of c…
-
High 8.3
Bitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)
An exploitable command execution vulnerability exists in the recovery partition of Bitdefender BOX 2, version 2.0.1.91. The API method `/api/update_setup` does not perform firmware signature checks atomically, leading to an exploitable race condition (TOCTTOU…
-
High 7.8
An information disclosure vulnerability leading to a potential local escalation of privilege in the procfs service (the…