899
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-364: Signal Handler Race Condition
Weakness ID : 364
Structure : Simple
Abstraction : Base
Description
The product uses a signal handler that introduces a race condition.
Extended Description
Race conditions frequently occur in signal handlers, since signal handlers support asynchronous
actions. These race conditions have a variety of root causes and symptoms. Attackers may be
able to exploit a signal handler race condition to cause the product state to be corrupted, possibly
leading to a denial of service or even code execution.
These issues occur when non-reentrant functions, or state-sensitive actions occur in the signal
handler, where they may be called at any time. These behaviors can violate assumptions being
made by the "regular" code that is interrupted, or by other signal handlers that may also be
invoked. If these functions are called at an inopportune moment - such as while a non-reentrant
function is already running - memory corruption could occur that may be exploitable for code
execution. Another signal race condition commonly found occurs when free is called within a signal
handler, resulting in a double free and therefore a write-what-where condition. Even if a given
pointer is set to NULL after it has been freed, a race condition still exists between the time the
memory was freed and the pointer was set to NULL. This is especially problematic if the same
signal handler has been set for more than one signal -- since it means that the signal handler itself
may be reentered.
There are several known behaviors related to signal handlers that have received the label of "signal
handler race condition":
• Shared state (e.g. global data or static variables) that are accessible to both a signal handler
and "regular" code
• Shared state between a signal handler and other signal handlers
• Use of non-reentrant functionality within a signal handler - which generally implies that shared
state is being used. For example, malloc() and free() are non-reentrant because they may
use global or static data structures for managing memory, and they are indirectly used by
innocent-seeming functions such as syslog(); these functions could be exploited for memory
corruption and, possibly, code execution.
• Association of the same signal handler function with multiple signals - which might imply
shared state, since the same code and resources are accessed. For example, this can be a
source of double-free and use-after-free weaknesses.
• Use of setjmp and longjmp, or other mechanisms that prevent a signal handler from returning
control back to the original functionality
• While not technically a race condition, some signal handlers are designed to be called at most
once, and being called more than once can introduce security problems, even when there are
not any concurrent calls to the signal handler. This can be a source of double-free and useafter-
free weaknesses.
Signal handler vulnerabilities are often classified based on the absence of a specific protection
mechanism, although this style of classification is discouraged in CWE because programmers
often have a choice of several different mechanisms for addressing the weakness. Such protection
CWE Version 4.14
CWE-364: Signal Handler Race Condition
CWE-364: Signal Handler Race Condition