901
Scope Impact Likelihood
also be executed with elevated privileges, possibly making
subsequent exploits more severe.
Potential Mitigations
Phase: Requirements
Strategy = Language Selection
Use a language that does not allow this weakness to occur or provides constructs that make this
weakness easier to avoid.
Phase: Architecture and Design
Design signal handlers to only set flags, rather than perform complex functionality. These flags
can then be checked and acted upon within the main program loop.
Phase: Implementation
Only use reentrant functions within signal handlers. Also, use validation to ensure that state is
consistent while performing asynchronous actions that affect the state of execution.
Demonstrative Examples
Example 1:
This code registers the same signal handler function with two different signals (CWE-831). If those
signals are sent to the process, the handler creates a log message (specified in the first argument
to the program) and exits.
Example Language: C (Bad)
char *logMessage;
void handler (int sigNum) {
syslog(LOG_NOTICE, "%s\n", logMessage);
free(logMessage);
/* artificially increase the size of the timing window to make demonstration of this weakness easier. */
sleep(10);
exit(0);
}
int main (int argc, char* argv[]) {
logMessage = strdup(argv[1]);
/* Register signal handlers. */
signal(SIGHUP, handler);
signal(SIGTERM, handler);
/* artificially increase the size of the timing window to make demonstration of this weakness easier. */
sleep(10);
}
The handler function uses global state (globalVar and logMessage), and it can be called by both
the SIGHUP and SIGTERM signals. An attack scenario might follow these lines:
• The program begins execution, initializes logMessage, and registers the signal handlers for
SIGHUP and SIGTERM.
• The program begins its "normal" functionality, which is simplified as sleep(), but could be any
functionality that consumes some time.
• The attacker sends SIGHUP, which invokes handler (call this "SIGHUP-handler").
• SIGHUP-handler begins to execute, calling syslog().
• syslog() calls malloc(), which is non-reentrant. malloc() begins to modify metadata to manage
the heap.
• The attacker then sends SIGTERM.
• SIGHUP-handler is interrupted, but syslog's malloc call is still executing and has not finished
modifying its metadata.
• The SIGTERM handler is invoked.
CWE Version 4.14
CWE-364: Signal Handler Race Condition
CWE-364: Signal Handler Race Condition