CWE

Use of a Non-reentrant Function in a Concurrent Context

ID: 663		Date: (C)2012-05-14   (M)2022-10-10
Type: weakness		Status: DRAFT
Abstraction Type: Base

Description

The software calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.

Applicable Platforms
None

Time Of Introduction

• Architecture and Design
• Implementation

Related Attack Patterns

• CAPEC-29

Common Consequences

Scope	Technical Impact	Notes
Integrity Confidentiality Other	Modify application data Read application data Alter execution logic

Detection Methods
None

Potential Mitigations

Phase	Strategy	Description	Effectiveness	Notes
Implementation		Use reentrant functions if available.
Implementation		Add synchronization to your non-reentrant function.
Implementation		In Java, use the ReentrantLock Class.

Relationships

Related CWE	Type	View	Chain
CWE-663 ChildOf CWE-894	Category	CWE-888

Demonstrative Examples
None

Observed Examples

1. CVE-2001-1349 : unsafe calls to library functions from signal handler
2. CVE-2004-2259 : handler for SIGCHLD uses non-reentrant functions

For more examples, refer to CVE relations in the bottom box.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings
None

References:

1. SUN .Java Concurrency API. Section:'Class ReentrantLock'.
2. Dipak Jha, Software Engineer, IBM .Use reentrant functions for safer signal handling.