Weakness (CWE)
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How to prevent it (1 mitigation)
-
Implementation
Use industry standard APIs to implement locking mechanism.
Source: MITRE CWE-667
188 results · Feed
-
Medium 5.5
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. U…
-
Medium 5.5
nfs_common: must not hold RCU while calling nfsd_file_put_local
In the Linux kernel, the following vulnerability has been resolved: nfs_common: must not hold RCU while calling nfsd_file_put_local Move holding the RCU from nfs_to_nfsd_file_put_local to nfs_to_nfsd_net_put. It is the call to nfs_to->nfsd_serv_put that requi…
-
Medium 5.5
usb: musb: Fix hardware lockup on first Rx endpoint request
In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix hardware lockup on first Rx endpoint request There is a possibility that a request's callback could be invoked from usb_ep_queue() (call trace below, supplemented with missing …
-
Medium 5.5
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disc…
-
Medium 5.5
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at dis…
-
High 7.8
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disc…
-
High 7.8
Bluetooth: MGMT: Fix possible deadlocks
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix possible deadlocks This fixes possible deadlocks like the following caused by hci_cmd_sync_dequeue causing the destroy function to run: INFO: task kworker/u19:0:143 block…
-
Medium 6.5
Deadlock in x86 HVM standard VGA handling
The hypervisor contains code to accelerate VGA memory accesses for HVM guests, when the (virtual) VGA is in "standard" mode. Locking involved there has an unusual discipline, leaving a lock acquired past the return from the function that acquired it. This beh…
-
Medium 5.5
drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTL Upon failure all locks need to be dropped before returning to the user. (cherry picked from commit 7d1a4258e602ffdc…
-
High 7.8
mm/thp: fix deferred split unqueue naming and locking
In the Linux kernel, the following vulnerability has been resolved: mm/thp: fix deferred split unqueue naming and locking Recent changes are putting more pressure on THP deferred split queues: under load revealing long-standing races, causing list_del corrupt…
-
Medium 4.4
io_uring/rw: fix missing NOWAIT check for O_DIRECT start write
In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: fix missing NOWAIT check for O_DIRECT start write When io_uring starts a write, it'll call kiocb_start_write() to bump the super block rwsem, preventing any freezes from happenin…
-
Medium 5.5
mptcp: init: protect sched with rcu_read_lock
In the Linux kernel, the following vulnerability has been resolved: mptcp: init: protect sched with rcu_read_lock Enabling CONFIG_PROVE_RCU_LIST with its dependence CONFIG_RCU_EXPERT creates this splat when an MPTCP socket is created: ========================…
-
High 7.8
rxrpc: Fix missing locking causing hanging calls
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing locking causing hanging calls If a call gets aborted (e.g. because kafs saw a signal) between it being queued for connection and the I/O thread picking up the call, the abo…
-
Medium 5.5
nilfs2: fix potential deadlock with newly created symlinks
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential deadlock with newly created symlinks Syzbot reported that page_symlink(), called by nilfs_symlink(), triggers memory reclamation involving the filesystem layer, which ca…
-
Medium 5.5
posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
In the Linux kernel, the following vulnerability has been resolved: posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() If get_clock_desc() succeeds, it calls fget() for the clockid's fd, and get the clk->rwsem read lock, so the error path …
-
High 7.8
ring-buffer: Fix reader locking when changing the sub buffer order
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix reader locking when changing the sub buffer order The function ring_buffer_subbuf_order_set() updates each ring_buffer_per_cpu and installs new sub buffers that match the req…
-
High 8.2
Improper account management vulnerability in NetIQ Advance Authentication
A vulnerability identified in NetIQ Advance Authentication that doesn't enforce account lockout when brute force attack is performed on API based login. This issue may lead to user account compromise if successful or may impact server performance. This issue …
-
Critical 9.8
In lwis_fence_signal of lwis_debug.c, there is a possible Use after Free due to improper locking. This could lead to lo…
-
High 7.5
mptcp: fix soft lookup in subflow_error_report()
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix soft lookup in subflow_error_report() Maxim reported a soft lookup in subflow_error_report(): watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [swapper/0:0] RIP: 0010:native_queue…
-
Medium 5.5
cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
In the Linux kernel, the following vulnerability has been resolved: cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cg…
-
Medium 5.3
vyper default functions don't respect nonreentrancy keys
Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a…
-
High 7.8
Mali GPU Kernel Driver exposes sensitive data from freed memory
A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain access to already freed memory.
-
Unscored —
Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will af…
-
Medium 5.3
Vyper has incorrect re-entrancy lock when key is empty string
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine (EVM). Starting in version 0.2.9 and prior to version 0.3.10, locks of the type `@nonreentrant("")` or `@nonreentrant('')` do not produce reentrancy checks at runtime. This issue is …
-
Medium 6.5
Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service
A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients co…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privile…
-
Medium 6.7
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege wi…
-
Medium 6.7
In vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege wi…
-
Medium 4.4
shiftfs lock unbalance in Ubuntu-specific kernels
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
-
High 7.8
In MediaCodec.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of p…
-
High 7.8
In multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper lockin…
-
Medium 6.7
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege…
-
Medium 6.7
In vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege…
-
High 7.5
Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if the SIP ALG is enabled and specific SIP messages are processed
An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series with MS-MPC or MS-MIC card and SRX Series allows an unauthenticated, network-based attacker to cause a flow processing daemon (flowd) crash and thereby a Denial of Serv…
-
High 7.5
Uniswap Universal Router Incorrect Authorization vulnerability
Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.
-
Medium 5.5
An issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, O…
-
High 7.8
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local e…
-
High 7.5
X.509 Policy Constraints Double Locking
If an X.509 certificate contains a malformed policy constraint and policy processing is enabled, then a write lock will be taken twice recursively. On some operating systems (most widely: Windows) this results in a denial of service when the affected process …