The product uses the singleton pattern when creating a resource within a multithreaded environment.
The use of a singleton pattern may not be thread-safe.
What can happen when CWE-543 is exploited.
Other, Modify Application Data
Affects: Other, Integrity
Typically introduced during these phases of the software lifecycle.
Languages
Practical mitigations for CWE-543, grouped by where in the lifecycle they apply.
Use the Thread-Specific Storage Pattern. See References.
Do not use member fields to store information in the Servlet. In multithreading environments, storing user data in Servlet member fields introduces a data access race condition.
Avoid using the double-checked locking pattern in language versions that cannot guarantee thread safety. This pattern may be used to avoid the overhead of a synchronized call, but in certain versions of Java (for example), this has been shown to be unsafe because it still introduces a race condition (CWE-209).
Effectiveness: Limited
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Illustrative examples from MITRE showing how the weakness appears in code.
This method is part of a singleton pattern, yet the following singleton() pattern is not thread-safe. It is possible that the method will create two objects instead of only one.
Vulnerable example
private static NumberConverter singleton;Common questions about CWE-543.
The product uses the singleton pattern when creating a resource within a multithreaded environment.
Use the Thread-Specific Storage Pattern. See References.
Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
Exploiting CWE-543 can lead to: Other, Modify Application Data.
Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.
Get alerted the moment a new CWE-543 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.