VNX-609: Double-Checked Locking

Field	Value
Rule ID	VNX-609
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-609
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	double-checked-locking cwe-609
Source	internal/sast/rules/vnx-609.rego

Overview

VNX-609 maps to CWE-609: Double-Checked Locking. It reports a synchronized (...) block immediately preceded by if (x == null), if (null == x) or if (!flag) and whose first statement repeats the same check, where x is a field declared in the same file without volatile.

Not reported: a volatile field, the local-variable idiom (Helper h = helper; if (h == null) ...) over a volatile field, a single check inside a synchronized method or block, AtomicReference checks, the holder-class idiom, and fields declared in another file.

Why This Matters

Without volatile, the Java memory model lets another thread see the reference assigned before the constructor’s writes are visible, so it uses a half-built object; with a boolean flag it can see the flag set before the data the flag guards.

What Gets Flagged

private static Registry instance;

if (instance == null) {
    synchronized (Registry.class) {      // flagged
        if (instance == null) {
            instance = new Registry();

Remediation

1. Declare the field volatile.
2. Or use the initialisation-on-demand holder class, an enum singleton, or eager initialisation.
3. For a confirmed false positive, add a // vulnetix-ignore: VNX-609 comment on the line.

References

• CWE-609: Double-Checked Locking
• The “Double-Checked Locking is Broken” Declaration

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-609
// nosec vnx-609

Or record an ignore rule: vulnetix ignore add --rule vnx-609 --reason "...". See Suppressing findings.