1149
Example Language: (Bad)
char *message;
void sh(int dummy) {
syslog(LOG_NOTICE,"%s\n",message);
sleep(10);
exit(0);
}
int main(int argc,char* argv[]) {
...
signal(SIGHUP,sh);
signal(SIGTERM,sh);
sleep(10);
exit(0);
}
If the execution of the first call to the signal handler is suspended after invoking syslog(), and the signal handler is called a
second time, the memory allocated by syslog() enters an undefined, and possibly, exploitable state.
Observed Examples
Reference Description
CVE-2005-0893 signal handler calls function that ultimately uses malloc()
https://www.cve.org/CVERecord?id=CVE-2005-0893
CVE-2004-2259 SIGCHLD signal to FTP server can cause crash under heavy load while
executing non-reentrant functions like malloc/free.
https://www.cve.org/CVERecord?id=CVE-2004-2259
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 745 CERT C Secure Coding Standard (2008) Chapter 12 -
Signals (SIG)
734 2349
MemberOf 847 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 4 - Expressions (EXP)
844 2363
MemberOf 879 CERT C++ Secure Coding Section 11 - Signals (SIG) 868 2379
MemberOf 1001 SFP Secondary Cluster: Use of an Improper API 888 2420
MemberOf 1166 SEI CERT C Coding Standard - Guidelines 11. Signals
(SIG)
1154 2460
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Unsafe function call from a signal
handler
CERT C Secure Coding SIG30-C Exact Call only asynchronous-safe functions
within signal handlers
CERT C Secure Coding SIG34-C Do not call signal() from within
interruptible signal handlers
The CERT Oracle Secure
Coding Standard for Java
(2011)
EXP01-J Never dereference null pointers
Software Fault Patterns SFP3 Use of an improper API
CWE Version 4.14
CWE-480: Use of Incorrect Operator
CWE-480: Use of Incorrect Operator