Upload
randy
View
45
Download
0
Tags:
Embed Size (px)
DESCRIPTION
Race Conditions. Consider the following Java code. int localData = theShared.getData (); localData ++; theShared.setData(localData );. public class Shared { private int data ; public Shared () { data = 0; } public void setData (int r ) { data = r ; - PowerPoint PPT Presentation
Citation preview
Consider the following Java code
Race ConditionsRace Conditions
public class Shared { private int data;
public Shared() { data = 0; }
public void setData(int r) { data = r; }
public int getData() { return data; }}
public class Shared { private int data;
public Shared() { data = 0; }
public void setData(int r) { data = r; }
public int getData() { return data; }}
int localData = theShared.getData();localData++;theShared.setData(localData);
int localData = theShared.getData();localData++;theShared.setData(localData);
After executing this code what value is stored in Shared.data?
What is a thread / process / task?
public class Driver { private Shared theShared; private MyThread threadA, threadB;
public Driver() { theShared = new Shared(); threadA = new MyThread(theShared); threadB = new MyThread(theShared); threadA.start(); threadB.start(); try { threadA.join(); threadB.join(); } catch (InterruptedException e) { e.printStackTrace(); } System.out.println(theShared.getData()); } }
public static void main(String[] args) { new Driver(); }}
public class Driver { private Shared theShared; private MyThread threadA, threadB;
public Driver() { theShared = new Shared(); threadA = new MyThread(theShared); threadB = new MyThread(theShared); threadA.start(); threadB.start(); try { threadA.join(); threadB.join(); } catch (InterruptedException e) { e.printStackTrace(); } System.out.println(theShared.getData()); } }
public static void main(String[] args) { new Driver(); }}
Threaded variation of the last program.
public class MyThread extends Thread { private Shared theShared;
public MyThread(Shared s) { theShared = s; }
public void run() { int localData = theShared.getData(); localData++; theShared.setData(localData); } }
public class MyThread extends Thread { private Shared theShared;
public MyThread(Shared s) { theShared = s; }
public void run() { int localData = theShared.getData(); localData++; theShared.setData(localData); } }
int localData = theShared.getData(); //1localData++; //2theShared.setData(localData); //3
int localData = theShared.getData(); //1localData++; //2theShared.setData(localData); //3
Code shared bythreadA and threadB
threadA -- execute //1threadA -- execute //2threadA -- execute //3threadB -- execute //1threadB -- execute //2threadB -- execute //3
Execution Scenario 1:threadB -- execute //1threadB -- execute //2threadB -- execute //3threadA -- execute //1threadA -- execute //2threadA -- execute //3
Execution Scenario 2:
threadA -- execute //1threadB -- execute //1threadB -- execute //2threadB -- execute //3threadA -- execute //2threadA -- execute //3
Execution Scenario 3:
Whenever the potential order of execution can alter the outcome, this is called a _________ or ___________.
Three essential properties for a race condition
_________ Property Two or more flows of control must execute concurrently/in parallel.
_____________ Property Some resource must be shared by the concurrent flows.
_____________ Property At least one of the concurrent flows must alter the state of the shared resource.
Solution to a race conditionSolution to a race conditioneliminate the concurrent access
The “trick” is to use an atomic operation, such as a lock.
import java.util.concurrent.locks.ReentrantLock;public class Driver { private Shared theShared; private MyThread threadA, threadB; private ReentrantLock theLock;
public Driver() { theShared = new Shared(); theLock = new ReetrantLock(); threadA = new MyThread(theShared, theLock); threadB = new MyThread(theShared, theLock); threadA.start(); threadB.start(); try { threadA.join(); threadB.join(); } catch (InterruptedException e) { e.printStackTrace(); } System.out.println(theShared.getData()); } }
public static void main(String[] args) { new Driver(); }}
import java.util.concurrent.locks.ReentrantLock;public class Driver { private Shared theShared; private MyThread threadA, threadB; private ReentrantLock theLock;
public Driver() { theShared = new Shared(); theLock = new ReetrantLock(); threadA = new MyThread(theShared, theLock); threadB = new MyThread(theShared, theLock); threadA.start(); threadB.start(); try { threadA.join(); threadB.join(); } catch (InterruptedException e) { e.printStackTrace(); } System.out.println(theShared.getData()); } }
public static void main(String[] args) { new Driver(); }}
import java.util.concurrent.locks.ReentrantLock;public class MyThread extends Thread { private Shared theShared; private ReentrantLock theLock;
public MyThread(Shared s, ReentrantLock l) {
theShared = s; theLock = l; }
public void run() { theLock.lock(); int localData = theShared.getData(); localData++; theShared.setData(localData); theLock.unlock(); } }
import java.util.concurrent.locks.ReentrantLock;public class MyThread extends Thread { private Shared theShared; private ReentrantLock theLock;
public MyThread(Shared s, ReentrantLock l) {
theShared = s; theLock = l; }
public void run() { theLock.lock(); int localData = theShared.getData(); localData++; theShared.setData(localData); theLock.unlock(); } }
Locks lead to another problem…Locks lead to another problem…
_________
What if one thread terminates inside a critical section?lockSharedResource(); // the critical sectionunlockSharedResource();
A thread is deadlocked when it is impossible forit to resume execution even though the expectedexecution for the thread is incomplete.
Potential Deadlock on two resources (A and B)
lockSharedResourceA(); lockSharedResourceB(); // the critical section unlockSharedResourceB();unlockSharedResourceA();
lockSharedResourceB(); lockSharedResourceA(); // the critical section unlockSharedResourceA();unlockSharedResourceB();
Process 1 Process 2
How can an attacker exploit race conditions?How can an attacker exploit race conditions?
Deadlock leads to _____.
Example: 2004 Apache HTTP Server http://www.kb.cert.org/vuls/id/132110
Concurrency, and therefore, race conditions are sensitive to …
processor speedsprocess/thread scheduling algorithmsmemory constraintsasynchronous eventsstate of unrelated processes
What about loosely coupled (untrusted) processes?
File targetFile = new File("/tmp/test");if (targetFile.exists() && targetFile.canRead()) { try { FileInputStream = new FileInputStream(targetFile); inFile.read( someBuffer ); ... inFile.close(); } catch (IOException e) { e.printStackTrace(); }}
File targetFile = new File("/tmp/test");if (targetFile.exists() && targetFile.canRead()) { try { FileInputStream = new FileInputStream(targetFile); inFile.read( someBuffer ); ... inFile.close(); } catch (IOException e) { e.printStackTrace(); }}
_________ (Time of Check, Time of Use)the window from TOC through TOU can leadto a race vulnerability
TOCTOU MitigationTOCTOU Mitigation________the file from other access.
File targetFile = new File("/tmp/test");if (targetFile.exists()) { try { FileChannel channel = null; FileLock lock = null; try { channel = new RandomAccessFile(targetFile,"rw").getChannel(); lock = channel.tryLock(); if (lock != null) { ByteBuffer bytes = ByteBuffer.allocate(100); channel.read(bytes); ... lock.release(); } else // file is already locked } catch (OverlappingFileLockException e) { // file is already locked } finally { channel.close(); } } catch (IOException e) { e.printStackTrace();}
File targetFile = new File("/tmp/test");if (targetFile.exists()) { try { FileChannel channel = null; FileLock lock = null; try { channel = new RandomAccessFile(targetFile,"rw").getChannel(); lock = channel.tryLock(); if (lock != null) { ByteBuffer bytes = ByteBuffer.allocate(100); channel.read(bytes); ... lock.release(); } else // file is already locked } catch (OverlappingFileLockException e) { // file is already locked } finally { channel.close(); } } catch (IOException e) { e.printStackTrace();}
A non-TOCTOU race condition: walking trees
...chdir( “/tmp/a” );chdir( “b” );chdir( “c” );// race windowchdir( “..” );unlink( “*” ); //delete all files...
...chdir( “/tmp/a” );chdir( “b” );chdir( “c” );// race windowchdir( “..” );unlink( “*” ); //delete all files...
Example (GNU utilities) file tree
A non-TOCTOU race condition: walking trees
...chdir( “/tmp/a” );chdir( “b” );chdir( “c” );// race windowchdir( “..” );unlink( “*” ); //delete all files...
...chdir( “/tmp/a” );chdir( “b” );chdir( “c” );// race windowchdir( “..” );unlink( “*” ); //delete all files...
Example (GNU utilities)
the exploit
mv /tmp/a/b/c /tmp/c
file tree
MitigationMitigation avoid the use of relative path names
use and verify ___________________
“..” and “.” in file names and URLs must be disallowed.
avoid using shared access containers
symlink vulsymlink vulThis is a classic problem in Unix systems involving the use of
symbolic links.
The problem is that an attacker's symbolic link can be substitutedfor a file. (Symbolic links can even reference directories.)
A classic example - passwd()
1) open some_dir/.rhosts to authenticate user; close .rhosts
2) create and open some_dir/ptmp
3) reopen some_dir/.rhosts and copy into opened ptmp
4) close files and rename some_dir/ptmp as some_dir/.rhosts
Suppose the user's directory is called victim_dir.
Further suppose that the attacker uses s similar directory calledattack_dir.
A classic example - passwd()
1) open some_dir/.rhosts to authenticate user; close .rhosts
2) create and open some_dir/ptmp
3) reopen some_dir/.rhosts and copy into opened ptmp
4) close files and rename some_dir/ptmp as some_dir/.rhosts
Attacker causes some_dir to be a link to attack_dir
Attacker causes some_dir to revert to victim_dir
Attacker causes some_dir to be a link to attack_dir
Attacker causes some_dir to revert to victim_dir
Mitigation – All Race ConditionsMitigation – All Race ConditionsClosing the race window
identify all shared resources
use mutual exclusion via locks, semaphores, monitors, etc.
Eliminating the race (shared) resource
be permission, authorization and privilege aware
Controlling access to the race (shared) resource
use “thread safe” threads
check file properties securely
use canonical full path names
use trustworthy containers
static and dynamic detection tools can find some race conditions