What is Unsynchronized Access to Shared Data (CWE-567)?

TL;DR: Unsynchronized Access to Shared Data in a Multithreaded Context (CWE-567) is when multiple threads access shared data without proper synchronization, leading to undefined behavior and potential data exposure. Ensure thread safety with constructs like synchronized blocks or methods.

What is Unsynchronized Access to Shared Data in a Multithreaded Context?

Unsynchronized Access to Shared Data in a Multithreaded Context (CWE-567) is a type of vulnerability that occurs when multiple threads access shared data without proper synchronization. This can lead to undefined behavior, race conditions, and inconsistent application state.

As defined by the MITRE Corporation under CWE-567, this issue arises from improper handling of static variables or other shared resources across threads in multithreaded applications. The OWASP Foundation does not directly classify this vulnerability under a specific category.

Quick Summary

Unsynchronized Access to Shared Data in a Multithreaded Context is critical because it can cause unpredictable changes to application state, leading to crashes and data corruption. It affects multi-threaded applications where shared resources are accessed concurrently without proper synchronization mechanisms. Developers and system administrators must ensure that thread safety measures are implemented correctly.

Jump to: Quick Summary · Unsynchronized Access to Shared Data in a Multithreaded Context Overview · How Unsynchronized Access to Shared Data in a Multithreaded Context Works · Business Impact of Unsynchronized Access to Shared Data in a Multithreaded Context · Unsynchronized Access to Shared Data in a Multithreaded Context Attack Scenario · How to Detect Unsynchronized Access to Shared Data in a Multithreaded Context · How to Fix Unsynchronized Access to Shared Data in a Multithreaded Context · Framework-Specific Fixes for Unsynchronized Access to Shared Data in a Multithreaded Context · How to Ask AI to Check Your Code for Unsynchronized Access to Shared Data in a Multithreaded Context · Unsynchronized Access to Shared Data in a Multithreaded Context Best Practices Checklist · Unsynchronized Access to Shared Data in a Multithreaded Context FAQ · Vulnerabilities Related to Unsynchronized Access to Shared Data in a Multithreaded Context · References · Scan Your Own Site

Unsynchronized Access to Shared Data in a Multithreaded Context Overview

What: This vulnerability occurs when multiple threads access shared data without proper synchronization.

Why it matters: Improper synchronization can lead to race conditions, inconsistent application state, and potential security issues such as data exposure or corruption.

Where it occurs: In multi-threaded applications where static variables or other shared resources are accessed concurrently.

Who is affected: Developers and system administrators responsible for maintaining multithreaded applications.

Who is NOT affected: Applications that do not use multithreading or properly synchronize access to shared resources.

How Unsynchronized Access to Shared Data in a Multithreaded Context Works

Root Cause

The root cause of this vulnerability lies in the lack of proper synchronization mechanisms for shared data accessed by multiple threads. This can result in race conditions and undefined behavior, leading to unpredictable application state changes.

Attack Flow

1. An attacker identifies that shared variables are not properly synchronized.
2. The attacker manipulates thread execution order or timing to trigger race conditions.
3. Unpredictable changes occur in the application’s internal state due to unsynchronized access.

Prerequisites to Exploit

• Multiple threads accessing shared data concurrently.
• Absence of proper synchronization mechanisms (e.g., synchronized blocks).

Vulnerable Code

public static int counter = 0;

public void incrementCounter() {
    counter++;
}

This code is vulnerable because it increments a static variable without any form of thread safety.

Secure Code

public static synchronized int incrementCounter() {
    return ++counter;
}

The secure version uses the synchronized keyword to ensure that only one thread can execute this method at a time, preventing race conditions.

Business Impact of Unsynchronized Access to Shared Data in a Multithreaded Context

Confidentiality

If shared variables contain sensitive data, an attacker may manipulate them to expose confidential information across user sessions.

Integrity

Unpredictable changes to shared data can corrupt the application’s internal state, causing it to malfunction or crash unexpectedly.

Availability

Race conditions and inconsistent application states can lead to instability and DoS (Denial of Service) attacks by crashing the application.

Unsynchronized Access to Shared Data in a Multithreaded Context Attack Scenario

1. Attacker identifies that shared variables are not properly synchronized.
2. Manipulates thread execution order or timing to trigger race conditions.
3. Exploits inconsistent state changes to corrupt sensitive data or cause application instability.

How to Detect Unsynchronized Access to Shared Data in a Multithreaded Context

Manual Testing

• Review code for improper use of synchronization mechanisms.
• Simulate concurrent execution scenarios to identify potential race conditions.

Automated Scanners (SAST / DAST)

Static analysis tools can detect the absence of proper synchronization constructs. Dynamic testing may be necessary to confirm actual race condition vulnerabilities in runtime environments.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, and Dalfox can identify unsynchronized access issues during automated scans.

False Positive Guidance

A real finding will show clear evidence of shared data being accessed without proper synchronization mechanisms. A false positive might occur if the code appears risky but is actually safe due to context a scanner cannot determine (e.g., external checks).

How to Fix Unsynchronized Access to Shared Data in a Multithreaded Context

• Remove use of static variables used between threads.
• Use synchronized access for shared resources.

Framework-Specific Fixes for Unsynchronized Access to Shared Data in a Multithreaded Context

Java

public class Counter {
    private int counter;

    public synchronized void incrementCounter() {
        this.counter++;
    }
}

Python/Django

class Counter:
    def __init__(self):
        self.counter = 0
    
    @synchronized
    def increment_counter(self):
        self.counter += 1

Node.js

let counter = 0;

function incrementCounter() {
    return new Promise((resolve) => {
        resolve(counter++);
    });
}

How to Ask AI to Check Your Code for Unsynchronized Access to Shared Data in a Multithreaded Context

Unsynchronized Access to Shared Data in a Multithreaded Context Best Practices Checklist

✅ Remove use of static variables used between threads. ✅ Use thread-safe constructs like synchronized blocks or methods for shared resources.

Unsynchronized Access to Shared Data in a Multithreaded Context FAQ

How does unsynchronized access to shared data in a multithreaded context work?

It occurs when static variables or other shared resources are accessed by multiple threads without proper synchronization, leading to race conditions and inconsistent state.

What impact can unsynchronized access have on an application’s integrity?

Unpredictable changes to shared data can corrupt the application’s internal state, causing it to malfunction or crash unexpectedly.

How does manual testing help identify unsynchronized access issues?

Manual testing involves reviewing code for improper use of synchronization mechanisms and simulating concurrent execution scenarios.

What are the best practices to prevent unsynchronized access to shared data?

Use thread-safe constructs like synchronized blocks or methods, and ensure that shared resources are properly managed across threads.

How does this vulnerability relate to CWE-820 Missing Synchronization?

CWE-567 is a specific instance of CWE-820 where synchronization mechanisms are missing in multithreaded applications.

How can an attacker exploit unsynchronized access for data leakage?

If shared variables contain sensitive information, attackers might manipulate them to expose confidential data across user sessions.

Vulnerabilities Related to Unsynchronized Access to Shared Data in a Multithreaded Context

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Unsynchronized Access to Shared Data in a Multithreaded Context and other risks before an attacker does.