1751
sleep(10);
exit(0);
}
int main (int argc, char* argv[]) {
logMessage = strdup(argv[1]);
/* Register signal handlers. */
signal(SIGHUP, handler);
signal(SIGTERM, handler);
/* artificially increase the size of the timing window to make demonstration of this weakness easier. */
sleep(10);
}
The handler function uses global state (globalVar and logMessage), and it can be called by both
the SIGHUP and SIGTERM signals. An attack scenario might follow these lines:
• The program begins execution, initializes logMessage, and registers the signal handlers for
SIGHUP and SIGTERM.
• The program begins its "normal" functionality, which is simplified as sleep(), but could be any
functionality that consumes some time.
• The attacker sends SIGHUP, which invokes handler (call this "SIGHUP-handler").
• SIGHUP-handler begins to execute, calling syslog().
• syslog() calls malloc(), which is non-reentrant. malloc() begins to modify metadata to manage
the heap.
• The attacker then sends SIGTERM.
• SIGHUP-handler is interrupted, but syslog's malloc call is still executing and has not finished
modifying its metadata.
• The SIGTERM handler is invoked.
• SIGTERM-handler records the log message using syslog(), then frees the logMessage
variable.
At this point, the state of the heap is uncertain, because malloc is still modifying the metadata for
the heap; the metadata might be in an inconsistent state. The SIGTERM-handler call to free() is
assuming that the metadata is inconsistent, possibly causing it to write data to the wrong location
while managing the heap. The result is memory corruption, which could lead to a crash or even
code execution, depending on the circumstances under which the code is running.
Note that this is an adaptation of a classic example as originally presented by Michal Zalewski
[REF-360]; the original example was shown to be exploitable for code execution.
Also note that the strdup(argv[1]) call contains a potential buffer over-read (CWE-126) if the
program is called without any arguments, because argc would be 0, and argv[1] would point
outside the bounds of the array.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
References
[REF-360]Michal Zalewski. "Delivering Signals for Fun and Profit". < https://lcamtuf.coredump.cx/
signals.txt >.2023-04-07.
[REF-361]"Race Condition: Signal Handling". < https://vulncat.fortify.com/en/detail?
id=desc.structural.cpp.race_condition_signal_handling#:~:text=Signal%20handling%20race
%20conditions%20can,installed%20to%20handle%20multiple%20signals.s >.2023-04-07.
CWE Version 4.14
CWE-832: Unlock of a Resource that is not Locked
CWE-832: Unlock of a Resource that is not Locked