public class MyThread extends Thread { try { private Shared theshared; threada.join(); threadb.join();

Transcription

1 Race Conditions Consider the following Java code int localdata = theshared.getdata(); localdata++; theshared.setdata(localdata); After executing this code what value is stored in Shared.data? public class Shared { private int data; public Shared() { data = 0; public void setdata(int r) { data = r; public int getdata() { return data; What is a thread / process / task? Threaded variation of the last program. public class Driver { private Shared theshared; private MyThread threada, threadb; public Driver() { theshared = new Shared(); threada = new MyThread(theShared); threadb = new MyThread(theShared); threada.start(); threadb.start(); public class MyThread extends Thread { private Shared theshared; threada.join(); threadb.join(); public MyThread(Shared s) { catch (InterruptedException e) { theshared = s; e.printstacktrace(); System.out.println(theShared.getData()); public void run() { int localdata = theshared.getdata(); localdata++; theshared.setdata(localdata); public static void main(string[] args) { new Driver(); 1

2 Code shared by threada and threadb Execution Scenario 1: threada -- execute //1 threada -- execute //2 threada -- execute //3 threadb -- execute //1 threadb -- execute //2 threadb -- execute //3 int localdata = theshared.getdata(); //1 localdata++; //2 theshared.setdata(localdata); //3 Execution Scenario 2: threadb -- execute //1 threadb -- execute //2 threadb -- execute //3 threada -- execute //1 threada -- execute //2 threada -- execute //3 Execution Scenario 3: threada -- execute //1 threadb -- execute //1 threadb -- execute //2 threadb -- execute //3 threada -- execute //2 threada -- execute //3 Whenever the potential order of execution can alter the outcome, this is called a or. Three essential properties for a race condition Property Two or more flows of control must execute concurrently/in parallel. Property Some resource must be shared by the concurrent flows. Property At least one of the concurrent flows must alter the state of the shared resource. 2

3 Solution to a race condition eliminate the concurrent access The trick is to use an atomic operation, such as a lock. import java.util.concurrent.locks.reentrantlock; public class Driver { private Shared theshared; private MyThread threada, threadb; private ReentrantLock thelock; public Driver() { theshared = new Shared(); thelock = new ReetrantLock(); threada = new MyThread(theShared, thelock); threadb = new MyThread(theShared, thelock); threada.start(); threadb.start(); threada.join(); threadb.join(); catch (InterruptedException e) { import java.util.concurrent.locks.reentrantlock; public class MyThread extends Thread { private Shared theshared; private ReentrantLock thelock; public MyThread(Shared s, e.printstacktrace(); ReentrantLock l) { theshared = s; thelock = l; System.out.println(theShared.getData()); public void run() { thelock.lock(); public static void main(string[] args) { int localdata = theshared.getdata(); new Driver(); localdata++; theshared.setdata(localdata); thelock.unlock(); 3

4 Locks lead to another problem A thread is deadlocked when it is impossible for it to resume execution even though the expected execution for the thread is incomplete. What if one thread terminates inside a critical section? locksharedresource(); // the critical section unlocksharedresource(); Potential Deadlock on two resources (A and B) Process 1 Process 2 locksharedresourcea(); locksharedresourceb(); // the critical section unlocksharedresourceb(); unlocksharedresourcea(); locksharedresourceb(); locksharedresourcea(); // the critical section unlocksharedresourcea(); unlocksharedresourceb(); How can an attacker exploit race conditions? Deadlock leads to. Example: 2004 Apache HTTP Server Concurrency, and therefore, race conditions are sensitive to processor speeds process/thread scheduling algorithms memory constraints asynchronous events state of unrelated processes 4

5 What about loosely coupled (untrusted) processes? File targetfile = new File("/tmp/test"); if (targetfile.exists() && targetfile.canread()) { FileInputStream = new FileInputStream(targetFile); infile.read( somebuffer ); infile.close(); catch (IOException e) { e.printstacktrace(); (Time of Check, Time of Use) the window from TOC through TOU can lead to a race vulnerability TOCTOU Mitigation the file from other access. File targetfile = new File("/tmp/test"); if (targetfile.exists()) { FileChannel channel = null; FileLock lock = null; channel = new RandomAccessFile(targetFile,"rw").getChannel(); lock = channel.trylock(); if (lock!= null) { ByteBuffer bytes = ByteBuffer.allocate(100); channel.read(bytes); lock.release(); else // file is already locked catch (OverlappingFileLockException e) { // file is already locked finally { channel.close(); catch (IOException e) { e.printstacktrace(); 5

6 A non-toctou race condition: walking trees Example (GNU utilities) file tree chdir( /tmp/a ); chdir( b ); chdir( c ); // race window chdir(.. ); unlink( * ); //delete all files A non-toctou race condition: walking trees Example (GNU utilities) file tree chdir( /tmp/a ); chdir( b ); chdir( c ); // race window chdir(.. ); unlink( * ); //delete all files the exploit mv /tmp/a/b/c /tmp/c! 6

7 Mitigation avoid the use of relative path names avoid using shared access containers.. and. in file names and URLs must be disallowed. use and verify symlink vul This is a classic problem in Unix systems involving the use of symbolic links. The problem is that an attacker's symbolic link can be substituted for a file. (Symbolic links can even reference directories.) A classic example - passwd() 1) open some_dir/.rhosts to authenticate user; close.rhosts 2) create and open some_dir/ptmp 3) reopen some_dir/.rhosts and copy into opened ptmp 4) close files and rename some_dir/ptmp as some_dir/.rhosts 7

8 Suppose the user's directory is called victim_dir. Further suppose that the attacker uses s similar directory called attack_dir. A classic example - passwd() Attacker causes some_dir to be a link to attack_dir 1) open some_dir/.rhosts to authenticate user; close.rhosts Attacker causes some_dir to revert to victim_dir 2) create and open some_dir/ptmp Attacker causes some_dir to be a link to attack_dir 3) reopen some_dir/.rhosts and copy into opened ptmp Attacker causes some_dir to revert to victim_dir 4) close files and rename some_dir/ptmp as some_dir/.rhosts Mitigation All Race Conditions Closing the race window use mutual exclusion via locks, semaphores, monitors, etc. use thread safe threads check file properties securely Eliminating the race (shared) resource identify all shared resources use canonical full path names Controlling access to the race (shared) resource be permission, authorization and privilege aware use trustworthy containers static and dynamic detection tools can find some race conditions 8