Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Draft Class
Structure: Simple
Description
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
A race condition occurs within concurrent environments, and it is effectively a property of a code sequence. Depending on the context, a code sequence may be in the form of a function call, a small number of instructions, a series of program invocations, etc. A race condition violates these properties, which are closely related: - Exclusivity - the code sequence is given exclusive access to the shared resource, i.e., no other code sequence can modify properties of the shared resource before the original sequence has completed execution. - Atomicity - the code sequence is behaviorally atomic, i.e., no other thread or process can concurrently execute the same sequence of instructions (or a subset) against the same resource. A race condition exists when an "interfering code sequence" can still access the shared resource, violating exclusivity. The interfering code sequence could be "trusted" or "untrusted." A trusted interfering code sequence occurs within the product; it cannot be modified by the attacker, and it can only be invoked indirectly. An untrusted interfering code sequence can be authored directly by the attacker, and typically it is external to the vulnerable product.
Common Consequences 4
Scope: Availability
Impact: DoS: Resource Consumption (CPU)DoS: Resource Consumption (Memory)DoS: Resource Consumption (Other)
When a race condition makes it possible to bypass a resource cleanup routine or trigger multiple initialization routines, it may lead to resource exhaustion.
Scope: Availability
Impact: DoS: Crash, Exit, or RestartDoS: Instability
When a race condition allows multiple control flows to access a resource simultaneously, it might lead the product(s) into unexpected states, possibly resulting in a crash.
Scope: ConfidentialityIntegrity
Impact: Read Files or DirectoriesRead Application Data
When a race condition is combined with predictable resource names and loose permissions, it may be possible for an attacker to overwrite or access confidential data (Improper Link Resolution Before File Access ('Link Following')).
Scope: Access Control
Impact: Execute Unauthorized Code or CommandsGain Privileges or Assume IdentityBypass Protection Mechanism
This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider.
Detection Methods 9
Black Box
Black box methods may be able to identify evidence of race conditions via methods such as multiple simultaneous connections, which may cause the software to become instable or crash. However, race conditions with very narrow timing windows would not be detectable.White Box
Common idioms are detectable in white box analysis, such as time-of-check-time-of-use (TOCTOU) file operations (Time-of-check Time-of-use (TOCTOU) Race Condition), or double-checked locking (Double-Checked Locking).Automated Dynamic AnalysisModerate
This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Race conditions may be detected with a stress-test by calling the software simultaneously from a large number of threads or processes, and look for evidence of any unexpected behavior.
Insert breakpoints or delays in between relevant code statements to artificially expand the race window so that it will be easier to detect.
Automated Static Analysis - Binary or BytecodeHigh
According to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Bytecode Weakness Analysis - including disassembler + source code weakness analysis
```
Cost effective for partial coverage:
```
Binary Weakness Analysis - including disassembler + source code weakness analysisDynamic Analysis with Automated Results InterpretationSOAR Partial
According to SOAR [REF-1479], the following detection techniques may be useful:
```
Cost effective for partial coverage:
```
Web Application Scanner
Web Services Scanner
Database ScannersDynamic Analysis with Manual Results InterpretationHigh
According to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Framework-based Fuzzer
```
Cost effective for partial coverage:
```
Fuzz Tester
Monitored Virtual Environment - run potentially malicious code in sandbox / wrapper / virtual machine, see if it does anything suspiciousManual Static Analysis - Source CodeHigh
According to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Manual Source Code Review (not inspections)
```
Cost effective for partial coverage:
```
Focused Manual Spotcheck - Focused manual analysis of sourceAutomated Static Analysis - Source CodeHigh
According to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Source code Weakness Analyzer
Context-configured Source Code Weakness AnalyzerArchitecture or Design ReviewHigh
According to SOAR [REF-1479], the following detection techniques may be useful:
```
Highly cost effective:
```
Formal Methods / Correct-By-Construction
```
Cost effective for partial coverage:
```
Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)Potential Mitigations 10
Phase: Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Phase: Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Phase: Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (Uncontrolled Resource Consumption).
Phase: Implementation
When using multithreading and operating on shared variables, only use thread-safe functions.
Phase: Implementation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Phase: Implementation
Use a mutex if available, but be sure to avoid related weaknesses such as Unrestricted Externally Accessible Lock.
Phase: Implementation
Avoid double-checked locking (Double-Checked Locking) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Phase: Implementation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Phase: Implementation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Phase: Architecture and DesignOperation
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Demonstrative Examples 3
This code could be used in an e-commerce application that supports transfers between accounts. It takes the total amount of the transfer, sends it to the new account, and deducts the amount from the original account.
Code Example:
Bad
Perl
perlA race condition could occur between the calls to GetBalanceFromDatabase() and SendNewBalanceToDatabase().
Suppose the balance is initially 100.00. An attack could be constructed as follows:
Code Example:
Attack
Other
otherAt this stage, the attacker should have a balance of 19.00 (due to 81.00 worth of transfers), but the balance is 99.00, as recorded in the database.
To prevent this weakness, the programmer has several options, including using a lock to prevent multiple simultaneous requests to the web application, or using a synchronization mechanism that includes all the code between GetBalanceFromDatabase() and SendNewBalanceToDatabase().
ID : DX-24
The following function attempts to acquire a lock in order to perform operations on a shared resource.Code Example:
Bad
C
c/* access shared resource /
cHowever, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason, the function may introduce a race condition into the program and result in undefined behavior.
In order to avoid data races, correctly written programs must check the result of thread synchronization functions and appropriately handle all errors, either by attempting to recover from them or reporting them to higher levels.
Code Example:
Good
C
c/* access shared resource /
cID : DX-132
Suppose a processor's Memory Management Unit (MMU) has 5 other shadow MMUs to distribute its workload for its various cores. Each MMU has the start address and end address of "accessible" memory. Any time this accessible range changes (as per the processor's boot status), the main MMU sends an update message to all the shadow MMUs.Suppose the interconnect fabric does not prioritize such "update" packets over other general traffic packets. This introduces a race condition. If an attacker can flood the target with enough messages so that some of those attack packets reach the target before the new access ranges gets updated, then the attacker can leverage this scenario.
Observed Examples 21
CVE-2022-29527Go application for cloud management creates a world-writable sudoers file that allows local attackers to inject sudo rules and escalate privileges to root by winning a race condition.
CVE-2021-1782Chain: improper locking (Improper Locking) leads to race condition (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')), as exploited in the wild per CISA KEV.
CVE-2021-0920Chain: mobile platform race condition (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) leading to use-after-free (Use After Free), as exploited in the wild per CISA KEV.
CVE-2020-6819Chain: race condition (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) leads to use-after-free (Use After Free), as exploited in the wild per CISA KEV.
CVE-2019-18827chain: JTAG interface is not disabled (On-Chip Debug and Test Interface With Improper Access Control) during ROM code execution, introducing a race condition (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) to extract encryption keys
CVE-2019-1161Chain: race condition (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) in anti-malware product allows deletion of files by creating a junction (Insecure Operation on Windows Junction / Mount Point) and using hard links during the time window in which a temporary file is created and deleted.
CVE-2015-1743TOCTOU in sandbox process allows installation of untrusted browser add-ons by replacing a file after it has been verified, but before it is executed
CVE-2014-8273Chain: chipset has a race condition (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) between when an interrupt handler detects an attempt to write-enable the BIOS (in violation of the lock bit), and when the handler resets the write-enable bit back to 0, allowing attackers to issue BIOS writes during the timing window [REF-1237].
CVE-2008-5044Race condition leading to a crash by calling a hook removal procedure while other activities are occurring at the same time.
CVE-2008-2958chain: time-of-check time-of-use (TOCTOU) race condition in program allows bypass of protection mechanism that was designed to prevent symlink attacks.
CVE-2008-1570chain: time-of-check time-of-use (TOCTOU) race condition in program allows bypass of protection mechanism that was designed to prevent symlink attacks.
CVE-2008-0058Unsynchronized caching operation enables a race condition that causes messages to be sent to a deallocated object.
CVE-2008-0379Race condition during initialization triggers a buffer overflow.
CVE-2007-6599Daemon crash by quickly performing operations and undoing them, which eventually leads to an operation that does not acquire a lock.
CVE-2007-6180chain: race condition triggers NULL pointer dereference
CVE-2007-5794Race condition in library function could cause data to be sent to the wrong process.
CVE-2007-3970Race condition in file parser leads to heap corruption.
CVE-2008-5021chain: race condition allows attacker to access an object while it is still being initialized, causing software to access uninitialized memory.
CVE-2009-4895chain: race condition for an argument value, possibly resulting in NULL dereference
CVE-2009-3547chain: race condition might allow resource to be released before operating on it, leading to NULL dereference
CVE-2006-5051Chain: Signal handler contains too much functionality (Signal Handler with Functionality that is not Asynchronous-Safe), introducing a race condition (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) that leads to a double free (Double Free).
References 13
24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, and John Viega
McGraw-Hill
2010
ID: REF-44
volatile - Multithreaded Programmer's Best Friend
Andrei Alexandrescu
Dr. Dobb's
01-02-2008
ID: REF-349
Thread-safe webapps using Spring
Steven Devijver
https://web.archive.org/web/20170609174845/http://www.javalobby.org/articles/thread-safe/index.jsp(2023-04-07)
ID: REF-350
Prevent race conditions
David Wheeler
04-10-2007
ID: REF-351
Race Conditions, Files, and Security Flaws; or the Tortoise and the Hare Redux
Matt Bishop
09-1995
ID: REF-352
Secure Programming for Linux and Unix HOWTO
David Wheeler
03-03-2003
ID: REF-353
Discovering and Exploiting Named Pipe Security Flaws for Fun and Profit
Blake Watts
04-2002
https://www.blakewatts.com/blog/discovering-and-exploiting-named-pipe-security-flaws-for-fun-and-profit(2023-04-07)
ID: REF-354
On Race Vulnerabilities in Web Applications
Roberto Paleari, Davide Marrone, Danilo Bruschi, and Mattia Monga
ID: REF-355
Avoiding Race Conditions and Insecure File Operations
Apple Developer Connection
ID: REF-356
Top 25 Series - Rank 25 - Race Conditions
Johannes Ullrich
SANS Software Security Institute
26-03-2010
ID: REF-357
Least Privilege
Sean Barnum and Michael Gegick
14-09-2005
ID: REF-76
Intel BIOS locking mechanism contains race condition that enables write protection bypass
CERT Coordination Center
05-01-2015
ID: REF-1237
State-of-the-Art Resources (SOAR) for Software Vulnerability Detection, Test, and Evaluation
Gregory Larsen, E. Kenneth Hong Fong, David A. Wheeler, and Rama S. Moorthy
07-2014
ID: REF-1479
Likelihood of Exploit
Medium
Applicable Platforms
Languages:
C : SometimesC++ : SometimesJava : Sometimes
Technologies:
Mobile : UndeterminedICS/OT : Undetermined
Modes of Introduction
Architecture and Design
Implementation
Related Attack Patterns
Alternate Terms
Race Condition
Affected Resources
- File or Directory
Related Weaknesses
CanPrecede:
Use After Free (CWE-416)
CanPrecede:
NULL Pointer Dereference (CWE-476)
Taxonomy Mapping
- PLOVER
- The CERT Oracle Secure Coding Standard for Java (2011)
Notes
MaintenanceThe relationship between race conditions and synchronization problems (Improper Synchronization) needs to be further developed. They are not necessarily two perspectives of the same core concept, since synchronization is only one technique for avoiding race conditions, and synchronization can be used for other purposes besides race condition prevention.
Research GapRace conditions in web applications are under-studied and probably under-reported. However, in 2008 there has been growing interest in this area.
Research GapMuch of the focus of race condition research has been in Time-of-check Time-of-use (TOCTOU) variants (Time-of-check Time-of-use (TOCTOU) Race Condition), but many race conditions are related to synchronization problems that do not necessarily require a time-of-check.
Research GapFrom a classification/taxonomy perspective, the relationships between concurrency and program state need closer investigation and may be useful in organizing related issues.