2088
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 557 Concurrency Issues 2329
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Other
Modify Memory
Read Memory
Modify Application Data
Read Application Data
Alter Execution Logic
Potential Mitigations
Phase: Implementation
Use reentrant functions if available.
Phase: Implementation
Add synchronization to your non-reentrant function.
Phase: Implementation
In Java, use the ReentrantLock Class.
Demonstrative Examples
Example 1:
In this example, a signal handler uses syslog() to log a message:
Example Language: (Bad)
char *message;
void sh(int dummy) {
syslog(LOG_NOTICE,"%s\n",message);
sleep(10);
exit(0);
}
int main(int argc,char* argv[]) {
...
signal(SIGHUP,sh);
signal(SIGTERM,sh);
sleep(10);
exit(0);
}
If the execution of the first call to the signal handler is suspended after invoking syslog(), and the signal handler is called a
second time, the memory allocated by syslog() enters an undefined, and possibly, exploitable state.
Example 2:
CWE Version 4.14
CWE-664: Improper Control of a Resource Through its Lifetime
CWE-664: Improper Control of a Resource Through its Lifetime