1750
Another rarely-explored possibility arises when the signal handler is only designed to be executed
once (if at all). By sending multiple signals, an attacker could invoke the function more than once.
This may generate extra, unintended side effects. A race condition might not even be necessary;
the attacker could send one signal, wait until it is handled, then send the other signal.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 364 Signal Handler Race Condition 899
Common Consequences
Scope Impact Likelihood
Availability
Integrity
Confidentiality
Access Control
Other
DoS: Crash, Exit, or Restart
Execute Unauthorized Code or Commands
Read Application Data
Gain Privileges or Assume Identity
Bypass Protection Mechanism
Varies by Context
The most common consequence will be a corruption
of the state of the product, possibly leading to a crash
or exit. However, if the signal handler is operating on
state variables for security relevant libraries or protection
mechanisms, the consequences can be far more severe,
including protection mechanism bypass, privilege
escalation, or information exposure.
Demonstrative Examples
Example 1:
This code registers the same signal handler function with two different signals.
Example Language: C (Bad)
void handler (int sigNum) {
...
}
int main (int argc, char* argv[]) {
signal(SIGUSR1, handler)
signal(SIGUSR2, handler)
}
Example 2:
This code registers the same signal handler function with two different signals (CWE-831). If those
signals are sent to the process, the handler creates a log message (specified in the first argument
to the program) and exits.
Example Language: C (Bad)
char *logMessage;
void handler (int sigNum) {
syslog(LOG_NOTICE, "%s\n", logMessage);
free(logMessage);
/* artificially increase the size of the timing window to make demonstration of this weakness easier. */
CWE Version 4.14
CWE-831: Signal Handler Function Associated with Multiple Signals
CWE-831: Signal Handler Function Associated with Multiple Signals