The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

What CVEs are caused by CWE-667?

146 recorded CVEs are attributed to CWE-667, including CVE-2021-1782, CVE-2025-43510, CVE-2021-22530. 2 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.

How do you prevent CWE-667?

Use industry standard APIs to implement locking mechanism.

How is CWE-667 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-667?

Exploiting CWE-667 can lead to: DoS: Resource Consumption (CPU).

Is CWE-667 actively exploited?

Yes. 2 CWE-667 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 146 recorded CVEs.

CWE-667: Improper Locking

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized.

Vulnerable example

java

private long someLongValue;

This code tries to obtain a lock for a file, then writes to it.

Vulnerable example

php

function writeToLog($message){

PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock().

The following function attempts to acquire a lock in order to perform operations on a shared resource.

Vulnerable example

void f(pthread_mutex_t *mutex) {

Safe example

int f(pthread_mutex_t *mutex) {

It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...

Vulnerable example

java

if (helper == null) {

Vulnerable example

java

helper = new Helper();

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2021-1782
CISA KEV
— Chain: improper locking (CWE-667) leads to race condition (CWE-362), as exploited in the wild per CISA KEV.
CVE-2009-0935 — Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice
CVE-2010-4210 — function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory.
CVE-2008-4302 — Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.
CVE-2009-1243 — OS kernel performs an unlock in some incorrect circumstances, leading to panic.
CVE-2009-2857 — OS deadlock
CVE-2009-1961 — OS deadlock involving 3 separate functions
CVE-2009-2699 — deadlock in library
CVE-2009-4272 — deadlock triggered by packets that force collisions in a routing table
CVE-2002-1850 — read/write deadlock between web server and script
CVE-2004-0174 — web server deadlock involving multiple listening connections
CVE-2009-1388 — multiple simultaneous calls to the same function trigger deadlock.
CVE-2006-5158 — chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833).
CVE-2006-4342 — deadlock when an operation is performed on a resource while it is being removed.
CVE-2006-2374 — Deadlock in device driver triggered by using file handle of a related device.
CVE-2006-2275 — Deadlock when large number of small messages cannot be processed quickly enough.
CVE-2005-3847 — OS kernel has deadlock triggered by a signal during a core dump.
CVE-2005-3106 — Race condition leads to deadlock.
CVE-2005-2456 — Chain: array index error (CWE-129) leads to deadlock (CWE-833)
CVE-2001-0682 — Program can not execute when attacker obtains a mutex.
CVE-2002-1914 — Program can not execute when attacker obtains a lock on a critical output file.
CVE-2002-1915 — Program can not execute when attacker obtains a lock on a critical output file.
CVE-2002-0051 — Critical file can be opened with exclusive read access by user, preventing application of security policy. Possibly related to improper permissions, large-window race condition.
CVE-2000-0338 — Chain: predictable file names used for locking, allowing attacker to create the lock beforehand. Resultant from permissions and randomness.
CVE-2000-1198 — Chain: Lock files with predictable names. Resultant from randomness.
CVE-2002-1869 — Product does not check if it can write to a log file, allowing attackers to avoid logging by accessing the file using an exclusive lock. Overlaps unchecked error condition. This is not quite CWE-412, but close.

CWE-667: Improper Locking

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-667

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Child

Terminology & mappings

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-667