Unsafe Function Call from Signal Handler

From Guidance Share

Jump to: navigation, search

Contents

Description

There are several functions which -- under certain circumstances, if used in a signal handler -- may result in the corruption of memory, allowing for exploitation of the process.

Applies To

  • Languages: C, C++, Assembly
  • Platforms: All

Example

The following example shows the use of an unsafe function from a signal hander:

void *global1, *global2;
char *what;
void sh(int dummy) { 
syslog(LOG_NOTICE,"%s\n",what); 
free(global2); 
free(global1); 
sleep(10); 
exit(0);
}

int main(int argc,char* argv[]) { 
what=argv[1]; 
global1=strdup(argv[2]); 
global2=malloc(340); 
signal(SIGHUP,sh); 
signal(SIGTERM,sh); 
sleep(10); 
exit(0);
}

Non-reentrant functions are functions that cannot safely be called, interrupted, and then recalled before the first call has finished without resulting in memory corruption. The function call syslog() is an example of this. In order to perform its functionality, it allocates a small amount of memory as “scratch space.” If syslog() is suspended by a signal call and the signal handler calls syslog(), the memory used by both of these functions enters an undefined, and possibly, exploitable state.

Impact

  • Access control: It may be possible to execute arbitrary code.
  • Integrity: Signal race conditions often result in data corruption.

Vulnerabilities

Signal or event handling code is not designed to be safely reentrant or calls into non-reentrant functions.

Countermeasures

  • Requirements specification: A language might be chosen, which is not subject to this flaw, through a guarantee of safely reentrant code.
  • Design: Design signal handlers to only set flags rather than perform complex functionality.
  • Implementation: Ensure that non-reentrant functions are not found in signal handlers. Also, use sanity checks to ensure that state is consistent be performing asynchronous actions which effect the state of execution.

Vulnerability Patterns

How Tos

Personal tools