VNX-920: Android wake lock acquired without a timeout

Field	Value
Rule ID	VNX-920
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, Kotlin
CWE	CWE-920
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	android wakelock power-consumption cwe-920
Source	internal/sast/rules/vnx-920.rego

Overview

An Android PowerManager.WakeLock or WifiManager.WifiLock is acquired with acquire() and no timeout. If the release is skipped (an exception, an early return, a killed callback) the device stays awake, or the Wi-Fi radio stays on, until the process dies. The rule reports X.acquire() where X is declared as a WakeLock/WifiLock or assigned from newWakeLock()/createWifiLock() in the same file, a chained newWakeLock(...).acquire(), and a bare acquire() inside a Kotlin apply { } opened on a newWakeLock line.

Why This Matters

A leaked wake lock drains the battery in hours and Android may restrict or flag the app for excessive wake-ups.

What Gets Flagged

pm.newWakeLock(PowerManager.FULL_WAKE_LOCK, "acme:play").acquire();
wakeLock.acquire();

pm.newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "acme:sync").apply {
    acquire()
}

Not flagged: acquire(timeout), acquire() on semaphores, locks and pools, test files, comments and strings. Whether a release() follows is not judged; Android lint’s WakelockTimeout check applies the same standard.

Remediation

Pass a timeout (acquire(10 * 60 * 1000L)) and release in a finally block, or use WorkManager, which manages wake locks for you.

References

• CWE-920: Improper Restriction of Power Consumption
• Android: Keep the device awake

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-920
// nosec vnx-920

Or record an ignore rule: vulnetix ignore add --rule vnx-920 --reason "...". See Suppressing findings.