CWE-479 – Signal Handler Use of a Non-reentrant Function

Read Time:1 Minute, 2 Second

Description

The program defines a signal handler that calls a non-reentrant function.

Modes of Introduction:

– Architecture and Design

 

Likelihood of Exploit: Low

 

Related Weaknesses

CWE-828
CWE-663
CWE-123

 

Consequences

Integrity, Confidentiality, Availability: Execute Unauthorized Code or Commands

It may be possible to execute arbitrary code through the use of a write-what-where condition.

Integrity: Modify Memory, Modify Application Data

Signal race conditions often result in data corruption.

 

Potential Mitigations

Phase: Requirements

Description: 

Require languages or libraries that provide reentrant functionality, or otherwise make it easier to avoid this weakness.

Phase: Architecture and Design

Description: 

Design signal handlers to only set flags rather than perform complex functionality.

Phase: Implementation

Description: 

Ensure that non-reentrant functions are not found in signal handlers.

Phase: Implementation

Effectiveness: Defense in Depth

Description: 

Use sanity checks to reduce the timing window for exploitation of race conditions. This is only a partial solution, since many attacks might fail, but other attacks still might work within the narrower window, even accidentally.

CVE References

  • CVE-2005-0893
    • signal handler calls function that ultimately uses malloc()
  • CVE-2004-2259
    • SIGCHLD signal to FTP server can cause crash under heavy load while executing non-reentrant functions like malloc/free.