898
Demonstrative Examples
Example 1:
This code prints the contents of a file if a user has permission.
Example Language: PHP (Bad)
function readFile($filename){
$user = getCurrentUser();
//resolve file if its a symbolic link
if(is_link($filename)){
$filename = readlink($filename);
}
if(fileowner($filename) == $user){
echo file_get_contents($realFile);
return;
}
else{
echo 'Access denied';
return false;
}
}
This code attempts to resolve symbolic links before checking the file and printing its contents.
However, an attacker may be able to change the file from a real file to a symbolic link between the
calls to is_link() and file_get_contents(), allowing the reading of arbitrary files. Note that this code
fails to log the attempted access (CWE-778).
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 748 CERT C Secure Coding Standard (2008) Appendix -
POSIX (POS)
734 2351
MemberOf 988 SFP Secondary Cluster: Race Condition Window 888 2412
MemberOf 1171 SEI CERT C Coding Standard - Guidelines 50. POSIX
(POS)
1154 2463
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Notes
Relationship
This is already covered by the "Link Following" weakness (CWE-59). It is included here because
so many people associate race conditions with link problems; however, not all link following
issues involve race conditions.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Race condition enabling link following
CERT C Secure Coding POS35-
C
Exact Avoid race conditions while checking
for the existence of a symbolic link
Software Fault Patterns SFP20 Race Condition Window
Related Attack Patterns
CAPEC-ID Attack Pattern Name
26 Leveraging Race Conditions
References
CWE Version 4.14
CWE-364: Signal Handler Race Condition
CWE-364: Signal Handler Race Condition