VNX-413: Improper Resource Locking

Java code that may run without the lock it needs or cannot release it: a bare tryLock() whose result is discarded, synchronized (new ...), and Lock.lock()/lockInterruptibly() whose unlock in the same method is not in a finally block or that is never unlocked.

Field	Value
Rule ID	`VNX-413`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-413
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`improper-resource-locking` `cwe-413`
Source	`internal/sast/rules/vnx-413.rego`

Overview

VNX-413 maps to CWE-413: Improper Resource Locking. The rule reports Java code that believes it holds exclusive access but may not, or that cannot reliably give it up.

Why This Matters

A discarded tryLock() result means the critical section runs whether or not the lock was obtained. synchronized (new Object()) excludes nobody. A lock released only on the success path stays held after an exception, and every later caller blocks.

What Gets Flagged

exportLock.tryLock();                 // FLAGGED: result discarded
synchronized (new Object()) { ... }   // FLAGGED: no shared monitor

lock.lock();                          // FLAGGED: unlock below is not in finally
value = Math.addExact(value, by);
lock.unlock();

rw.readLock().lock();                 // FLAGGED: never unlocked
return items.get(key);

Not flagged: lock.lock(); try { ... } finally { lock.unlock(); }, if (lock.tryLock(...)) or an assigned tryLock result, a lock taken in one method and released in another (acquire/close pairs), lock() on types that are not java.util.concurrent locks, test files, comments and strings.

Remediation

Always pair lock() with try { ... } finally { lock.unlock(); } placed immediately after it.
Branch on the result of tryLock().
Synchronize on a private final field shared by every caller.
For confirmed false positives, add a // vulnetix-ignore: VNX-413 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-413
// nosec vnx-413

Or record an ignore rule: vulnetix ignore add --rule vnx-413 --reason "...". See Suppressing findings.