CWE-832 对未加锁的资源进行解锁

admin 2021年11月10日02:10:13评论62 views字数 1455阅读4分51秒阅读模式

CWE-832 对未加锁的资源进行解锁

Unlock of a Resource that is not Locked

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software attempts to unlock a resource that is not locked.

扩展描述

Depending on the locking functionality, an unlock of a non-locked resource might cause memory corruption or other modification to the resource (or its associated metadata that is used for tracking locks).

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 667 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 667 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

范围 影响 注释
['Integrity', 'Confidentiality', 'Availability', 'Other'] ['DoS: Crash, Exit, or Restart', 'Execute Unauthorized Code or Commands', 'Modify Memory', 'Other'] Depending on the locking being used, an unlock operation might not have any adverse effects. When effects exist, the most common consequence will be a corruption of the state of the software, possibly leading to a crash or exit; depending on the implementation of the unlocking, memory corruption or code execution could occur.

分析过的案例

标识 说明 链接
CVE-2010-4210 function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4210
CVE-2008-4302 Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4302
CVE-2009-1243 OS kernel performs an unlock in some incorrect circumstances, leading to panic. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1243

文章来源于互联网:scap中文网

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2021年11月10日02:10:13
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                   CWE-832 对未加锁的资源进行解锁http://cn-sec.com/archives/613586.html

发表评论

匿名网友 填写信息