Skip to content
OpenAdvisories

Weakness (CWE)

CWE-667: Improper Locking

Class Draft

The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

How to prevent it (1 mitigation)

  1. Implementation

    Use industry standard APIs to implement locking mechanism.

Source: MITRE CWE-667

All Critical High Medium Low Exploited only Public exploit

49 results · Clear filters · Feed

  • High 7.8
    CVE-2022-20566

    In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local e…

    linux-raspi2 linux-hwe linux-azure linux-riscv Android Debian Ubuntu
  • High 7.5
    CVE-2022-3996

    X.509 Policy Constraints Double Locking

    If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process …

    OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine Wolfi crates.io
  • High 7.8
    CVE-2022-32811

    A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macO…

    Apple macOS macOS
  • High 7.5
    CVE-2022-22175

    Junos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processed

    An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated networked attacker to cause a flowprocessing daemon (flowd) crash and thereby a Denial of Service (DoS). Continued receipt of t…

    Juniper Networks Junos OS Network devices
  • High 7.0
    CVE-2021-1782 Exploited Public exploit

    A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…

    Apple macOS iOS and iPadOS macOS iOS
    KEV Nov 3, 2021
  • High 7.5
    CVE-2020-13246

    Denial of Service in Gitea

    An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.

    code.gitea.io/gitea github.com/go-gitea/gitea Go
  • High 7.0
    CVE-2019-14898

    The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw…

    Linux kernel kernel linux-azure linux-hwe-edge Ubuntu
  • High 7.5
    CVE-2019-10072 EPSS 73%

    Improper Locking in Apache Tomcat

    The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients wer…

    tomcat8 tomcat9 tomcat9 org.apache.tomcat.embed:tomcat-embed-core Debian Ubuntu Maven
  • High 7.8
    CVE-2002-0051

    Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files w…