1454
The following code relies on getlogin() to determine whether or not a user is trusted. It is easily
subverted.
Example Language: C (Bad)
pwd = getpwnam(getlogin());
if (isTrustedGroup(pwd->pw_gid)) {
allow();
} else {
deny();
}
Observed Examples
Reference Description
CVE-2001-1349 unsafe calls to library functions from signal handler
https://www.cve.org/CVERecord?id=CVE-2001-1349
CVE-2004-2259 SIGCHLD signal to FTP server can cause crash under heavy load while
executing non-reentrant functions like malloc/free.
https://www.cve.org/CVERecord?id=CVE-2004-2259
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 986 SFP Secondary Cluster: Missing Lock 888 2411
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Related Attack Patterns
CAPEC-ID Attack Pattern Name
29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
References
[REF-547]SUN. "Java Concurrency API". < https://docs.oracle.com/javase/1.5.0/docs/api/java/util/
concurrent/locks/ReentrantLock.html >.2023-04-07.
[REF-548]Dipak Jha, Software Engineer, IBM. "Use reentrant functions for safer signal handling". <
https://archive.ph/rl1XR >.2023-04-07.
CWE-664: Improper Control of a Resource Through its Lifetime
Weakness ID : 664
Structure : Simple
Abstraction : Pillar
Description
The product does not maintain or incorrectly maintains control over a resource throughout its
lifetime of creation, use, and release.
Extended Description
Resources often have explicit instructions on how to be created, used and destroyed. When code
does not follow these instructions, it can lead to unexpected behaviors and potentially exploitable
states.
CWE Version 4.14
CWE-664: Improper Control of a Resource Through its Lifetime
CWE-664: Improper Control of a Resource Through its Lifetime