903
Reference Description
CVE-1999-0035 Signal handler does not disable other signal handlers, allowing it to be
interrupted, causing other functionality to access files/etc. with raised privileges
https://www.cve.org/CVERecord?id=CVE-1999-0035
CVE-2001-0905 Attacker can send a signal while another signal handler is already running,
leading to crash or execution with root privileges
https://www.cve.org/CVERecord?id=CVE-2001-0905
CVE-2001-1349 unsafe calls to library functions from signal handler
https://www.cve.org/CVERecord?id=CVE-2001-1349
CVE-2004-0794 SIGURG can be used to remotely interrupt signal handler; other variants exist
https://www.cve.org/CVERecord?id=CVE-2004-0794
CVE-2004-2259 SIGCHLD signal to FTP server can cause crash under heavy load while
executing non-reentrant functions like malloc/free.
https://www.cve.org/CVERecord?id=CVE-2004-2259
Functional Areas
• Signals
• Interprocess Communication
Affected Resources
• System Process
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 361 7PK - Time and State 700 2320
MemberOf 884 CWE Cross-section 884 2567
MemberOf 986 SFP Secondary Cluster: Missing Lock 888 2411
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Signal handler race condition
7 Pernicious Kingdoms Signal Handling Race Conditions
CLASP Race condition in signal handler
Software Fault Patterns SFP19 Missing Lock
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-360]Michal Zalewski. "Delivering Signals for Fun and Profit". < https://lcamtuf.coredump.cx/
signals.txt >.2023-04-07.
[REF-361]"Race Condition: Signal Handling". < https://vulncat.fortify.com/en/detail?
id=desc.structural.cpp.race_condition_signal_handling#:~:text=Signal%20handling%20race
%20conditions%20can,installed%20to%20handle%20multiple%20signals.s >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE Version 4.14
CWE-366: Race Condition within a Thread
CWE-366: Race Condition within a Thread