CWE
CWE/SANS Top 25 Most Dangerous Software Errors Common Weakness Scoring System
Common Weakness Risk Analysis Framework
Home > CWE List > CWE- Individual Dictionary Definition (2.1)  

CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations

 
Dangerous Signal Handler not Disabled During Sensitive Operations
Weakness ID: 432 (Weakness Base)Status: Draft
+ Description

Description Summary

The application uses a signal handler that shares state with other signal handlers, but it does not properly mask or prevent those signal handlers from being invoked while the original signal handler is still running.

Extended Description

During the execution of a signal handler, it can be interrupted by another handler when a different signal is sent. If the two handlers share state - such as global variables - then an attacker can corrupt the state by sending another signal before the first handler has completed execution.

+ Time of Introduction
  • Architecture and Design
  • Implementation
+ Applicable Platforms

Languages

Language-independent

+ Common Consequences
ScopeEffect
Integrity

Technical Impact: Modify application data

+ Potential Mitigations

Phase: Implementation

Turn off dangerous handlers when performing sensitive operations.

+ Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness BaseWeakness Base364Signal Handler Race Condition
Development Concepts (primary)699
Research Concepts (primary)1000
ChildOfCategoryCategory429Handler Errors
Development Concepts699
+ Taxonomy Mappings
Mapped Taxonomy NameNode IDFitMapped Node Name
CERT C Secure CodingSIG00-CMask signals handled by noninterruptible signal handlers
PLOVERDangerous handler not cleared/disabled during sensitive operations
+ Content History
Submissions
Submission DateSubmitterOrganizationSource
PLOVERExternally Mined
Modifications
Modification DateModifierOrganizationSource
2008-07-01Eric DalciCigitalExternal
updated Potential_Mitigations, Time_of_Introduction
2008-09-08CWE Content TeamMITREInternal
updated Relationships, Taxonomy_Mappings
2008-10-14CWE Content TeamMITREInternal
updated Description
2010-12-13CWE Content TeamMITREInternal
updated Applicable_Platforms, Description, Name, Potential_Mitigations, Relationships, Taxonomy_Mappings
2011-06-01CWE Content TeamMITREInternal
updated Common_Consequences
Previous Entry Names
Change DatePrevious Entry Name
2008-04-11Dangerous Handler not Cleared/Disabled During Sensitive Operations
2010-12-13Dangerous Handler not Disabled During Sensitive Operations
Page Last Updated: September 12, 2011