CWE-832 对未加锁的资源进行解锁
Unlock of a Resource that is not Locked
结构: Simple
Abstraction: Base
状态: Incomplete
被利用可能性: unkown
基本描述
The software attempts to unlock a resource that is not locked.
扩展描述
Depending on the locking functionality, an unlock of a non-locked resource might cause memory corruption or other modification to the resource (or its associated metadata that is used for tracking locks).
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 667 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 667 cwe_View_ID: 699 cwe_Ordinal: Primary
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| ['Integrity', 'Confidentiality', 'Availability', 'Other'] | ['DoS: Crash, Exit, or Restart', 'Execute Unauthorized Code or Commands', 'Modify Memory', 'Other'] | Depending on the locking being used, an unlock operation might not have any adverse effects. When effects exist, the most common consequence will be a corruption of the state of the software, possibly leading to a crash or exit; depending on the implementation of the unlocking, memory corruption or code execution could occur. |
分析过的案例
| 标识 | 说明 | 链接 |
|---|---|---|
| CVE-2010-4210 | function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4210 |
| CVE-2008-4302 | Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4302 |
| CVE-2009-1243 | OS kernel performs an unlock in some incorrect circumstances, leading to panic. | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1243 |