Use of a Non-reentrant Function in a Concurrent Context

Opis

The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.

Skutki

• Integrity, Confidentiality, Other

  Modify Memory; Read Memory; Modify Application Data; Read Application Data; Alter Execution Logic

Zapobieganie

• Implementation

  Use reentrant functions if available.

• Implementation

  Add synchronization to your non-reentrant function.

• Implementation

  In Java, use the ReentrantLock Class.

Przykłady podatności

• CVE-2001-1349 unsafe calls to library functions from signal handler
• CVE-2004-2259 SIGCHLD signal to FTP server can cause crash under heavy load while executing non-reentrant functions like malloc/free.

Słabość nadrzędna

• CWE-662 Improper Synchronization

Słabości podrzędne

• CWE-479 Signal Handler Use of a Non-reentrant Function
• CWE-558 Use of getlogin() in Multithreaded Application

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, C

Źródła

1. Java Concurrency API — SUN, Class ReentrantLock
2. Use reentrant functions for safer signal handling — Dipak Jha, Software Engineer, IBM