CWE-833

BaseIncomplete

View on MITRE

Deadlock

The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.

17 linked vulnerabilities

2 related weaknesses

Availability

DoS: Resource Consumption (CPU)

DoS: Resource Consumption (Other)

DoS: Crash, Exit, or Restart

Each thread of execution will "hang" and prevent tasks from completing. In some cases, CPU consumption may occur if a lock check occurs in a tight loop.

Automated Static Analysis

Effectiveness: High

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Modes of Introduction

Implementation

Related Weaknesses

CWE-667ChildOf CWE-662ChildOf

Example CVEs (15)

CVE-1999-1476

A bug in some Intel Pentium processors allow DoS (hang) via an invalid "CMPXCHG8B" instruction, causing a deadlock

CVE-2009-2857

OS deadlock

CVE-2009-1961

OS deadlock involving 3 separate functions

CVE-2009-2699

deadlock in library

CVE-2009-4272

deadlock triggered by packets that force collisions in a routing table

External Links

MITRE CWE Database