VNX-572: Call to Thread run() instead of start()

Field	Value
Rule ID	VNX-572
Severity	Low
SARIF level	note
Kind	sast
Languages	Java, Kotlin
CWE	CWE-572
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	no-invocation thread concurrency cwe-572
Source	internal/sast/rules/vnx-572.rego

Overview

VNX-572 maps to CWE-572: Call to Thread run() instead of start(). Thread.run() is an ordinary method call: it executes the thread’s work on the current thread and returns when it finishes. No new thread is created. The caller blocks, and whatever the thread was meant to provide (concurrency, a watchdog, isolation of a slow or hostile task) is lost.

What Gets Flagged

new Thread(task, "report").run();

Thread worker = new Thread(task);
worker.run();

new Thread(() -> {
    for (String k : keys) {
        cache.load(k);
    }
}).run();

val t = Thread(work, "indexer")
t.run()
Thread { rebuild() }.run()

The receiver must be declared in the same file as a Thread (field, local, parameter, var t = new Thread(...), Thread.ofVirtual().unstarted(...), val t = Thread(...)) or as a class of the file that extends Thread.

What Is Not Flagged

• start().
• run() on a Runnable or any other type.
• super.run() inside a run() override.
• Kotlin’s run { } scope function.
• The call in comments or string literals.

Remediation

1. Call start() to run the work on the new thread, and join() if the caller must wait.
2. If the work should run on the current thread, call the Runnable directly and drop the Thread.
3. Prefer an ExecutorService for pooled background work.

References

• CWE-572: Call to Thread run() instead of start()

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-572
// nosec vnx-572

Or record an ignore rule: vulnetix ignore add --rule vnx-572 --reason "...". See Suppressing findings.