VNX-675: Single-use operation repeated on the same handle (double close, relock, double unlock)

Reports C and C++ code that closes the same FILE*, descriptor or DIR* twice, locks a pthread mutex again before unlocking it, or unlocks it twice, in straight-line code.

Field	Value
Rule ID	`VNX-675`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++
CWE	CWE-675
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`multiple-operations-single-call` `cwe-675` `double-close` `mutex`
Source	`internal/sast/rules/vnx-675.rego`

Overview

VNX-675 maps to CWE-675: Multiple Operations on Resource in Single-Operation Context. Some operations may happen once per resource. The rule reports the second one when it follows the first within 20 lines of the same block, with nothing in between that resets the handle:

fclose(), close(), closedir() or pclose() (also C++ ::close / std::fclose) of the same expression twice. A second fclose is undefined behaviour; a second close(fd) can close an unrelated file that another thread has just been given the same descriptor number for.
pthread_mutex_lock() of the same mutex again before pthread_mutex_unlock(): a default mutex deadlocks.
pthread_mutex_unlock() twice with no lock in between: undefined behaviour.

What Gets Flagged

fclose(fp);
log_info("exported %d rows", n);
fclose(fp);                       /* FLAGGED */

pthread_mutex_lock(&qlock);
q->items[q->tail++] = item;
pthread_mutex_lock(&qlock);       /* FLAGGED: deadlock */

What Is Not Flagged

A reassignment in between (fp = fopen(...), fd = -1, *fp = NULL, &fp passed to a function), or an unlock (lock) of the mutex in between.
A return/goto/break/continue/exit/abort, an else/case/default, a preprocessor #else/#elif, or the end of the block holding the first call (an error path and its main path, two branches).
Different handles, calls behind a condition on the same line, comments and string literals.

free() twice is VNX-415. Format strings with %n, which an earlier version of this rule matched, are not a CWE-675 weakness and are no longer reported here.

Remediation

Release each handle exactly once and mark it released:

fclose(fp);
fp = NULL;

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-675
// nosec vnx-675

Or record an ignore rule: vulnetix ignore add --rule vnx-675 --reason "...". See Suppressing findings.