CWE-667 加锁机制不恰当

Improper Locking

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software does not properly acquire a lock on a resource, or it does not properly release a lock on a resource, leading to unexpected resource state changes and behaviors.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 662 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 662 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

范围 影响 注释
Availability DoS: Resource Consumption (CPU) Inconsistent locking discipline can lead to deadlock.

可能的缓解方案

Implementation

策略: Libraries or Frameworks

Use industry standard APIs to implement locking mechanism.

示例代码

例

In the following Java snippet, methods are defined to get and set a long field in an instance of a class that is shared across multiple threads. Because operations on double and long are nonatomic in Java, concurrent access may cause unexpected behavior. Thus, all operations on long and double fields should be synchronized.

bad Java

private long someLongValue;
public long getLongValue() {
return someLongValue;
}

public void setLongValue(long l) {
someLongValue = l;
}

例

This code tries to obtain a lock for a file, then writes to it.

bad PHP

function writeToLog($message){
$logfile = fopen("logFile.log", "a");
//attempt to get logfile lock
if (flock($logfile, LOCK_EX)) {
fwrite($logfile,$message);
// unlock logfile
flock($logfile, LOCK_UN);
}
else {
print "Could not obtain lock on logFile.log, message not recorded\n";
}
}
fclose($logFile);

PHP by default will wait indefinitely until a file lock is released. If an attacker is able to obtain the file lock, this code will pause execution, possibly leading to denial of service for other users. Note that in this case, if an attacker can perform an flock() on the file, they may already have privileges to destroy the log file. However, this still impacts the execution of other programs that depend on flock().

例

The following function attempts to acquire a lock in order to perform operations on a shared resource.

bad C

void f(pthread_mutex_t mutex) {
pthread_mutex_lock(mutex);

/ access shared resource */


pthread_mutex_unlock(mutex);
}

However, the code does not check the value returned by pthread_mutex_lock() for errors. If pthread_mutex_lock() cannot acquire the mutex for any reason the function may introduce a race condition into the program and result in undefined behavior.

In order to avoid data races correctly written programs must check the result of thread synchronization functions and appropriately handle all errors, either by attempting to recover from them or reporting it to higher levels.

good

int f(pthread_mutex_t mutex) {
int result;

result = pthread_mutex_lock(mutex);
if (0 != result)
return result;


/ access shared resource */


return pthread_mutex_unlock(mutex);
}

例

It may seem that the following bit of code achieves thread safety while avoiding unnecessary synchronization...

bad Java

if (helper == null) {
synchronized (this) {
if (helper == null) {
helper = new Helper();
}
}
}
return helper;

The programmer wants to guarantee that only one Helper() object is ever allocated, but does not want to pay the cost of synchronization every time this code is called.

Suppose that helper is not initialized. Then, thread A sees that helper==null and enters the synchronized block and begins to execute:

bad

helper = new Helper();

If a second thread, thread B, takes over in the middle of this call and helper has not finished running the constructor, then thread B may make calls on helper while its fields hold incorrect values.

分析过的案例

标识 说明 链接
CVE-2009-0935 Attacker provides invalid address to a memory-reading function, causing a mutex to be unlocked twice https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0935
CVE-2010-4210 function in OS kernel unlocks a mutex that was not previously locked, causing a panic or overwrite of arbitrary memory. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4210
CVE-2008-4302 Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4302
CVE-2009-1243 OS kernel performs an unlock in some incorrect circumstances, leading to panic. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1243
CVE-2009-2857 OS deadlock https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2857
CVE-2009-1961 OS deadlock involving 3 separate functions https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1961
CVE-2009-2699 deadlock in library https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2699
CVE-2009-4272 deadlock triggered by packets that force collisions in a routing table https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4272
CVE-2002-1850 read/write deadlock between web server and script https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1850
CVE-2004-0174 web server deadlock involving multiple listening connections https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0174
CVE-2009-1388 multiple simultaneous calls to the same function trigger deadlock. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1388
CVE-2006-5158 chain: other weakness leads to NULL pointer dereference (CWE-476) or deadlock (CWE-833). https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5158
CVE-2006-4342 deadlock when an operation is performed on a resource while it is being removed. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4342
CVE-2006-2374 Deadlock in device driver triggered by using file handle of a related device. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2374
CVE-2006-2275 Deadlock when large number of small messages cannot be processed quickly enough. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2275
CVE-2005-3847 OS kernel has deadlock triggered by a signal during a core dump. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3847
CVE-2005-3106 Race condition leads to deadlock. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3106
CVE-2005-2456 Chain: array index error (CWE-129) leads to deadlock (CWE-833) https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2456
CVE-2001-0682 Program can not execute when attacker obtains a mutex. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0682
CVE-2002-1914 Program can not execute when attacker obtains a lock on a critical output file. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1914
CVE-2002-1915 Program can not execute when attacker obtains a lock on a critical output file. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1915
CVE-2002-0051 Critical file can be opened with exclusive read access by user, preventing application of security policy. Possibly related to improper permissions, large-window race condition. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0051
CVE-2000-0338 Chain: predictable file names used for locking, allowing attacker to create the lock beforehand. Resultant from permissions and randomness. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0338
CVE-2000-1198 Chain: Lock files with predictable names. Resultant from randomness. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-1198
CVE-2002-1869 Product does not check if it can write to a log file, allowing attackers to avoid logging by accessing the file using an exclusive lock. Overlaps unchecked error condition. This is not quite CWE-412, but close. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1869

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
CERT C Secure Coding CON31-C CWE More Abstract Do not destroy a mutex while it is locked
CERT C Secure Coding POS48-C CWE More Abstract Do not unlock or destroy another POSIX thread's mutex
The CERT Oracle Secure Coding Standard for Java (2011) VNA00-J Ensure visibility when accessing shared primitive variables
The CERT Oracle Secure Coding Standard for Java (2011) VNA02-J Ensure that compound operations on shared variables are atomic
The CERT Oracle Secure Coding Standard for Java (2011) VNA05-J Ensure atomicity when reading and writing 64-bit values
The CERT Oracle Secure Coding Standard for Java (2011) LCK06-J Do not use an instance lock to protect shared static data
Software Fault Patterns SFP19 Missing Lock
OMG ASCSM ASCSM-CWE-667

相关攻击模式

  • CAPEC-25
  • CAPEC-26
  • CAPEC-27

引用