CWE-479: Unsafe Function Call from a Signal Handler
Unsafe Function Call from a Signal Handler
Weakness ID: 479 (Weakness Variant)
Status: Draft
Description
Description Summary
The program has a signal handler that calls an unsafe function,
leading to unpredictable results.
Extended Description
There are several functions which -- under certain circumstances, if used
in a signal handler -- may result in the corruption of memory, allowing for
exploitation of the process.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
C
C++
Common Consequences
Scope
Effect
Access Control
It may be possible to execute arbitrary code through the use of a
write-what-where condition.
Integrity
Signal race conditions often result in data corruption.
Likelihood of Exploit
Low
Demonstrative Examples
Example 1
See Signal handler race condition, for an example usage of free() in
a signal handler which is exploitable.
Potential Mitigations
Phase
Description
Requirements specification: A language might be chosen, which is not
subject to this flaw, through a guarantee of reentrant code.
Architecture and Design
Design signal handlers to only set flags rather than perform complex
functionality.
Implementation
Ensure that non-reentrant functions are not found in signal handlers.
Also, use sanity checks to ensure that state is consistently performing
asynchronous actions which effect the state of execution.
Other Notes
This flaw is a subset of race conditions occurring in signal handler calls
which is concerned primarily with memory corruption caused by calls to
non-reentrant functions in signal handlers. Non-reentrant functions are
functions that cannot safely be called, interrupted, and then recalled
before the first call has finished without resulting in memory corruption.
The function call syslog() is an example of this. In order to perform its
functionality, it allocates a small amount of memory as "scratch space." If
syslog() is suspended by a signal call and the signal handler calls
syslog(), the memory used by both of these functions enters an undefined,
and possibly, exploitable state.
Description
