Weakness (CWE)
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How to prevent it (1 mitigation)
-
Implementation
Use industry standard APIs to implement locking mechanism.
Source: MITRE CWE-667
121 results · Clear filters · Feed
-
Medium 5.5
Bluetooth: iso: Fix circular lock in iso_conn_big_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Fix circular lock in iso_conn_big_sync This fixes the circular locking dependency warning below, by reworking iso_sock_recvmsg, to ensure that the socket lock is always releas…
-
Medium 5.5
btrfs: don't take dev_replace rwsem on task already holding it
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from…
-
Medium 5.5
dma-debug: fix a possible deadlock on radix_lock
In the Linux kernel, the following vulnerability has been resolved: dma-debug: fix a possible deadlock on radix_lock radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock otherwise, there's a possible deadlock scenario when dma debug API is ca…
-
Medium 5.5
pinmux: Use sequential access to access desc->pinmux data
In the Linux kernel, the following vulnerability has been resolved: pinmux: Use sequential access to access desc->pinmux data When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while acces…
-
Medium 5.5
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. U…
-
Medium 5.5
nfs_common: must not hold RCU while calling nfsd_file_put_local
In the Linux kernel, the following vulnerability has been resolved: nfs_common: must not hold RCU while calling nfsd_file_put_local Move holding the RCU from nfs_to_nfsd_file_put_local to nfs_to_nfsd_net_put. It is the call to nfs_to->nfsd_serv_put that requi…
-
Medium 5.5
usb: musb: Fix hardware lockup on first Rx endpoint request
In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix hardware lockup on first Rx endpoint request There is a possibility that a request's callback could be invoked from usb_ep_queue() (call trace below, supplemented with missing …
-
Medium 5.5
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disc…
-
Medium 5.5
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at dis…
-
Medium 6.5
Deadlock in x86 HVM standard VGA handling
The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involved there has an unusual discipline, leaving a lock acquired past the return from the function that acquired it. This beh…
-
Medium 5.5
drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL Upon failure all locks need to be dropped before returning to the user. (cherry picked from commit 7d1a4258e602ffdc…
-
Medium 4.4
io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happenin…
-
Medium 5.5
mptcp: init: protect sched with rcu_read_lock
In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcu_read_lock Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT creates this splat when an MPTCP socket is created: ========================…
-
Medium 5.5
nilfs2: fix potential deadlock with newly created symlinks
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential deadlock with newly created symlinks Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which ca…
-
Medium 5.5
posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() If get_clock_desc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path …
-
Medium 5.5
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cg…
-
Medium 5.3
vyper default functions don't respect nonreentrancy keys
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a…
-
Medium 5.3
Vyper has incorrect re-entrancy lock when key is empty string
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is …
-
Medium 6.5
Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service
A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients co…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege wi…
-
Medium 6.7
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege wi…
-
Medium 4.4
shiftfs lock unbalance in Ubuntu-specific kernels
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
-
Medium 6.7
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege…
-
Medium 6.7
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege…
-
Medium 5.5
An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, O…
-
Medium 6.2
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 5.5
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 5.5
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can…
-
Medium 4.7
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL po…
-
Medium 5.3
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
-
Medium 4.4
Improper locking in the Power Management Controller (PMC) for some Intel Chipset firmware before versions pmc_fw_lbg_c1…
-
Medium 5.9
Missing release of locks in PJSIP
PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function re…
-
Medium 5.5
Deadlock in mutually recursive `tf.function` objects
TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock…
-
Medium 6.5
Improper Locking in github.com/containers/storage
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…
-
Medium 5.9
Data race in va-ts
An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
-
Medium 5.6
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…
-
Medium 5.5
The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between th…