This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Code Correctness: Double-Checked Locking"
Weilin Zhong (talk | contribs) |
|||
| Line 2: | Line 2: | ||
{{Template:Fortify}} | {{Template:Fortify}} | ||
| − | + | Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}''' | |
| + | __TOC__ | ||
| − | + | [[ASDR_TOC_Vulnerabilities|Vulnerabilities Table of Contents]] | |
| + | |||
| + | [[ASDR Table of Contents]] | ||
==Description== | ==Description== | ||
| + | |||
| + | Double-checked locking is an incorrect idiom that does not achieve the intended effect. | ||
Many talented individuals have spent a great deal of time pondering ways to make double-checked locking work in order to improve performance. None have succeeded. | Many talented individuals have spent a great deal of time pondering ways to make double-checked locking work in order to improve performance. None have succeeded. | ||
| + | |||
| + | ==Risk Factors== | ||
| + | TBD | ||
==Examples == | ==Examples == | ||
| Line 30: | Line 38: | ||
| − | ==Related | + | ==Related [[Attacks]]== |
| + | |||
| + | * [[Attack 1]] | ||
| + | * [[Attack 2]] | ||
| + | |||
| − | ==Related | + | ==Related [[Vulnerabilities]]== |
| − | ==Related | + | * [[Vulnerability 1]] |
| + | * [[Vulnerabiltiy 2]] | ||
| + | |||
| + | |||
| + | ==Related [[Controls]]== | ||
| + | |||
| + | * [[Control 1]] | ||
| + | * [[Control 2]] | ||
| + | |||
| + | |||
| + | ==Related [[Technical Impacts]]== | ||
| + | |||
| + | * [[Technical Impact 1]] | ||
| + | * [[Technical Impact 2]] | ||
| − | |||
==References== | ==References== | ||
| − | [1] D. Bacon et al. The "Double-Checked Locking is Broken" Declaration. http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html. | + | * [[1] D. Bacon et al. The "Double-Checked Locking is Broken" Declaration. http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html. |
| + | |||
| + | [[Category:FIXME|need subcategory | ||
| + | In addition, one should classify vulnerability based on the following subcategories: Ex:<nowiki>[[Category:Error Handling Vulnerability]]</nowiki> | ||
| + | |||
| + | Availability Vulnerability | ||
| + | |||
| + | Authorization Vulnerability | ||
| + | |||
| + | Authentication Vulnerability | ||
| + | |||
| + | Concurrency Vulnerability | ||
| + | |||
| + | Configuration Vulnerability | ||
| + | |||
| + | Cryptographic Vulnerability | ||
| + | |||
| + | Encoding Vulnerability | ||
| + | |||
| + | Error Handling Vulnerability | ||
| + | |||
| + | Input Validation Vulnerability | ||
| + | |||
| + | Logging and Auditing Vulnerability | ||
| + | |||
| + | Session Management Vulnerability]] | ||
| + | |||
| + | __NOTOC__ | ||
| + | |||
| − | |||
[[Category:Synchronization and Timing Vulnerability]] | [[Category:Synchronization and Timing Vulnerability]] | ||
| − | |||
[[Category:Java]] | [[Category:Java]] | ||
| − | |||
[[Category:Implementation]] | [[Category:Implementation]] | ||
| − | |||
[[Category:Code Snippet]] | [[Category:Code Snippet]] | ||
| + | [[Category:OWASP ASDR Project]] | ||
Revision as of 11:03, 23 September 2008
This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.
- This article includes content generously donated to OWASP by
Last revision (mm/dd/yy): 09/23/2008
Vulnerabilities Table of Contents
Description
Double-checked locking is an incorrect idiom that does not achieve the intended effect.
Many talented individuals have spent a great deal of time pondering ways to make double-checked locking work in order to improve performance. None have succeeded.
Risk Factors
TBD
Examples
At first blush it may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization.
if (fitz == null) {
synchronized (this) {
if (fitz == null) {
fitz = new Fitzer();
}
}
}
return fitz;
The programmer wants to guarantee that only one Fitzer() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called. This idiom is known as double-checked locking.
Unfortunately, it does not work, and multiple Fitzer() objects can be allocated. See The "Double-Checked Locking is Broken" Declaration for more details [1].
Related Attacks
Related Vulnerabilities
Related Controls
Related Technical Impacts
References
- [[1] D. Bacon et al. The "Double-Checked Locking is Broken" Declaration. http://www.cs.umd.edu/~pugh/java/memoryModel/DoubleCheckedLocking.html.
