Race Condition in Thread

From Guidance Share

Jump to: navigation, search

Contents

Description

If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.

Applies To

  • Languages: Any language with threads
  • Operating platforms: All

Example

The code below increments a static counter and checks to ensure it is not greater than a specific value:

#define MaxCounter 10
int IncrementCounter()
{
static int counter = 0;
counter++;
if (counter > MaxCounter) 
  return MaxCounter;
else
  return counter; 
}

If multiple threads are using this function it is possible for the return value to be larger than MaxCounter. This would occur if one thread had already conducted the check on counter and was about to return and another thread then incremented counter before it was returned by the first thread.

Impact

  • Undefined: This flaw will result in the system state going out of sync.

Vulnerabilities

  • Failure to properly lock resources that are shared by multiple threads.

Countermeasures

  • Design: Use a language which provides facilities to easily use threads safely.
  • Implementation: Use resource locking constructs, such as mutex and semaphore, to ensure threads don't attempt write access to a resource simultaneously.

Vulnerability Patterns

How Tos

Personal tools