Read Time:46 Second

Description

The software uses the singleton pattern when creating a resource within a multithreaded environment.

The use of a singleton pattern may not be thread-safe.

Modes of Introduction:

– Implementation

 

 

Related Weaknesses

CWE-820
CWE-662
CWE-662

 

Consequences

Other, Integrity: Other, Modify Application Data

 

Potential Mitigations

Phase: Architecture and Design

Description: 

Use the Thread-Specific Storage Pattern. See References.

Phase: Implementation

Description: 

Do not use member fields to store information in the Servlet. In multithreading environments, storing user data in Servlet member fields introduces a data access race condition.

Phase: Implementation

Effectiveness: Limited

Description: 

Avoid using the double-checked locking pattern in language versions that cannot guarantee thread safety. This pattern may be used to avoid the overhead of a synchronized call, but in certain versions of Java (for example), this has been shown to be unsafe because it still introduces a race condition (CWE-209).

CVE References