Race condition within a thread - Revision history

KirstenS at 12:26, 7 April 2009

2009-04-07T12:26:38Z

KirstenS at 00:29, 18 February 2009

2009-02-18T00:29:20Z

KirstenS at 23:59, 5 November 2008

2008-11-05T23:59:33Z

KirstenS at 13:39, 30 September 2008

2008-09-30T13:39:50Z

KirstenS at 13:39, 30 September 2008

2008-09-30T13:39:22Z

Weilin Zhong at 21:23, 4 August 2006

2006-08-04T21:23:51Z

Pravir Chandra at 04:08, 28 May 2006

2006-05-28T04:08:10Z

Deleted user at 18:33, 16 May 2006

2006-05-16T18:33:14Z

Deleted user: /* Examples */

2006-04-16T16:09:03Z

‎Examples

Jeff Williams at 22:44, 13 April 2006

2006-04-13T22:44:35Z

New page

{{Template:SecureSoftware}}

==Overview==

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

==Consequences ==

* Integrity: The main problem is that - if a lock is overcome - data could be altered in a bad state.

==Exposure period ==

* Design: Use a language which provides facilities to easily use threads safely.

==Platform ==

* Languages: Any language with threads

* Operating platforms: All

==Required resources ==

Any

==Severity ==

High

==Likelihood of exploit ==

Medium

==Avoidance and mitigation ==

==Discussion ==

* Design: Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multi-threaded environment.

* Design: Create resource-locking sanity checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.

==Examples ==

In C/C++:

int foo = 0;
int storenum(int num)
{
static int counter = 0;
counter++;
if (num > foo)
foo = num;
return foo;
}
In Java:

public classRace {
static int foo = 0;

public static void main() {
new Threader().start();
foo = 1;
}

public static class Threader extends Thread {
public void run() {
System.out.println(foo);
}
}
}
==Related problems ==

Not available.

==Categories ==

[[Category:Vulnerability]]

[[Category:Synchronization and Timing Errror]]

← Older revision		Revision as of 12:26, 7 April 2009
Line 2:		Line 2:

	#REDIRECT [[Race Conditions]]		#REDIRECT [[Race Conditions]]
−
−	~~__TOC__~~
−
−	~~[[ASDR Table of Contents]]~~

@@ Line 1: / Line 1: @@
-{{Template:Vulnerability}}
+{{template:CandidateForDeletion}}
-{{Template:SecureSoftware}}
 __TOC__
@@ Line 6: / Line 7: @@
 [[ASDR Table of Contents]]
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
@@ Line 113: / Line 112: @@
 TBD

@@ Line 1: / Line 1: @@
 {{Template:Vulnerability}}
 {{Template:SecureSoftware}}
 [[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
@@ Line 6: / Line 11: @@
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''

@@ Line 110: / Line 110: @@
 ==References==
-* [http://cwe.mitre.org/data/definitions/79.html CWE 79].
+TBD
 [[Category:FIXME|add links

@@ Line 1: / Line 1: @@
 {{Template:SecureSoftware}}
@@ Line 79: / Line 80: @@
 [[Category:Vulnerability]]
+[[Category:Synchronization and Timing Vulnerability]]
 [[Category:OWASP_CLASP_Project]]

@@ Line 2: / Line 2: @@
 {{Template:SecureSoftware}}
-==Overview==
+[[Category:FIXME|This is the text from the old template. This needs to be rewritten using the new template.]]
 If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
-==Consequences ==
+'''Consequences'''
-*	Integrity: The main problem is that - if a lock is overcome - data could be altered in a bad state.
+* Integrity: The main problem is that - if a lock is overcome - data could be altered in a bad state.
-==Exposure period ==
+'''Exposure period'''
-*	Design: Use a language which provides facilities to easily use threads safely.
+* Design: Use a language which provides facilities to easily use threads safely.
-==Platform ==
+'''Platform'''
-*	Languages: Any language with threads
+* Languages: Any language with threads
-*	Operating platforms: All
+'''Required resources'''
 Any
-==Severity ==
+'''Severity'''
 High
-==Likelihood   of exploit ==
+'''Likelihood of exploit'''
 Medium
-==Avoidance and mitigation ==
+* Design: Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multi-threaded environment.
-==Discussion ==
+==Risk Factors==
-*	Design: Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multi-threaded environment.
+TBD
-==Examples ==
+==Examples==
 In C/C++:
@@ Line 74: / Line 85: @@
 </pre>
-Not available.
+==Related [[Attacks]]==
 [[Category:Vulnerability]]
 [[Category:Synchronization and Timing Vulnerability]]

← Older revision		Revision as of 18:33, 16 May 2006
Line 1:		Line 1:
−

	{{Template:SecureSoftware}}		{{Template:SecureSoftware}}
Line 84:		Line 83:

	[[Category:Synchronization and Timing Errror]]		[[Category:Synchronization and Timing Errror]]
		+
		+	[[Category:OWASP_CLASP_Project]]

@@ Line 45: / Line 45: @@
 In C/C++:
 int foo = 0;
      int storenum(int num)
@@ Line 54: / Line 55: @@
              return foo;
+     }
 In Java:
-public classRace {
+<pre>public classRace {
    static int foo = 0;
@@ Line 70: / Line 73: @@
+   }
+}
 ==Related problems ==