Safe Concurrency
V15.4.1
Verify that shared objects in multi-threaded code (such as caches, files, or in-memory objects accessed by multiple threads) are accessed safely by using thread-safe types and synchronization mechanisms like locks or semaphores to avoid race conditions and data corruption.
Required for Level 3
Related CAPEC™ Requirements
V15.4.2
Verify that checks on a resource's state, such as its existence or permissions, and the actions that depend on them are performed as a single atomic operation to prevent time-of-check to time-of-use (TOCTOU) race conditions. For example, checking if a file exists before opening it, or verifying a users access before granting it.
Required for Level 3
Related CAPEC™ Requirements
V15.4.3
Verify that locks are used consistently to avoid threads getting stuck, whether by waiting on each other or retrying endlessly, and that locking logic stays within the code responsible for managing the resource to ensure locks cannot be inadvertently or maliciously modified by external classes or code.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 124, 125, 227, 25, 469, 603, 607
V15.4.4
Verify that resource allocation policies prevent thread starvation by ensuring fair access to resources, such as by leveraging thread pools, allowing lower-priority threads to proceed within a reasonable timeframe.
Required for Level 3
Related CAPEC™ Requirements
CAPEC™ (3.9): 124, 125, 227, 25, 469, 603, 607
Disclaimer
Credit via OWASP ASVS.For more information visit: The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v4.0 license.
