CVE Vulnerabilities

CVE-2009-0875

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Published: Mar 12, 2009 | Modified: Apr 02, 2009
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
6.9 MEDIUM
AV:L/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

Race condition in the Doors subsystem in the kernel in Sun Solaris 8 through 10, and OpenSolaris before snv_94, allows local users to cause a denial of service (process hang), or possibly bypass file permissions or gain kernel-context privileges, via vectors involving the time at which control is transferred from a caller to a door server.

Weakness

The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.

Affected Software

Name Vendor Start Version End Version
Opensolaris Sun * snv_93 (including)
Opensolaris Sun snv_01 (including) snv_01 (including)
Opensolaris Sun snv_02 (including) snv_02 (including)
Opensolaris Sun snv_03 (including) snv_03 (including)
Opensolaris Sun snv_04 (including) snv_04 (including)
Opensolaris Sun snv_05 (including) snv_05 (including)
Opensolaris Sun snv_06 (including) snv_06 (including)
Opensolaris Sun snv_07 (including) snv_07 (including)
Opensolaris Sun snv_08 (including) snv_08 (including)
Opensolaris Sun snv_09 (including) snv_09 (including)
Opensolaris Sun snv_10 (including) snv_10 (including)
Opensolaris Sun snv_11 (including) snv_11 (including)
Opensolaris Sun snv_12 (including) snv_12 (including)
Opensolaris Sun snv_13 (including) snv_13 (including)
Opensolaris Sun snv_14 (including) snv_14 (including)
Opensolaris Sun snv_15 (including) snv_15 (including)
Opensolaris Sun snv_16 (including) snv_16 (including)
Opensolaris Sun snv_17 (including) snv_17 (including)
Opensolaris Sun snv_18 (including) snv_18 (including)
Opensolaris Sun snv_19 (including) snv_19 (including)
Opensolaris Sun snv_20 (including) snv_20 (including)
Opensolaris Sun snv_21 (including) snv_21 (including)
Opensolaris Sun snv_22 (including) snv_22 (including)
Opensolaris Sun snv_23 (including) snv_23 (including)
Opensolaris Sun snv_24 (including) snv_24 (including)
Opensolaris Sun snv_25 (including) snv_25 (including)
Opensolaris Sun snv_26 (including) snv_26 (including)
Opensolaris Sun snv_27 (including) snv_27 (including)
Opensolaris Sun snv_28 (including) snv_28 (including)
Opensolaris Sun snv_29 (including) snv_29 (including)
Opensolaris Sun snv_30 (including) snv_30 (including)
Opensolaris Sun snv_31 (including) snv_31 (including)
Opensolaris Sun snv_32 (including) snv_32 (including)
Opensolaris Sun snv_33 (including) snv_33 (including)
Opensolaris Sun snv_34 (including) snv_34 (including)
Opensolaris Sun snv_35 (including) snv_35 (including)
Opensolaris Sun snv_36 (including) snv_36 (including)
Opensolaris Sun snv_37 (including) snv_37 (including)
Opensolaris Sun snv_38 (including) snv_38 (including)
Opensolaris Sun snv_39 (including) snv_39 (including)
Opensolaris Sun snv_40 (including) snv_40 (including)
Opensolaris Sun snv_41 (including) snv_41 (including)
Opensolaris Sun snv_42 (including) snv_42 (including)
Opensolaris Sun snv_43 (including) snv_43 (including)
Opensolaris Sun snv_44 (including) snv_44 (including)
Opensolaris Sun snv_45 (including) snv_45 (including)
Opensolaris Sun snv_46 (including) snv_46 (including)
Opensolaris Sun snv_47 (including) snv_47 (including)
Opensolaris Sun snv_48 (including) snv_48 (including)
Opensolaris Sun snv_49 (including) snv_49 (including)
Opensolaris Sun snv_50 (including) snv_50 (including)
Opensolaris Sun snv_51 (including) snv_51 (including)
Opensolaris Sun snv_52 (including) snv_52 (including)
Opensolaris Sun snv_53 (including) snv_53 (including)
Opensolaris Sun snv_54 (including) snv_54 (including)
Opensolaris Sun snv_55 (including) snv_55 (including)
Opensolaris Sun snv_56 (including) snv_56 (including)
Opensolaris Sun snv_57 (including) snv_57 (including)
Opensolaris Sun snv_58 (including) snv_58 (including)
Opensolaris Sun snv_59 (including) snv_59 (including)
Opensolaris Sun snv_60 (including) snv_60 (including)
Opensolaris Sun snv_61 (including) snv_61 (including)
Opensolaris Sun snv_62 (including) snv_62 (including)
Opensolaris Sun snv_63 (including) snv_63 (including)
Opensolaris Sun snv_64 (including) snv_64 (including)
Opensolaris Sun snv_65 (including) snv_65 (including)
Opensolaris Sun snv_66 (including) snv_66 (including)
Opensolaris Sun snv_67 (including) snv_67 (including)
Opensolaris Sun snv_68 (including) snv_68 (including)
Opensolaris Sun snv_69 (including) snv_69 (including)
Opensolaris Sun snv_70 (including) snv_70 (including)
Opensolaris Sun snv_71 (including) snv_71 (including)
Opensolaris Sun snv_72 (including) snv_72 (including)
Opensolaris Sun snv_73 (including) snv_73 (including)
Opensolaris Sun snv_74 (including) snv_74 (including)
Opensolaris Sun snv_75 (including) snv_75 (including)
Opensolaris Sun snv_76 (including) snv_76 (including)
Opensolaris Sun snv_77 (including) snv_77 (including)
Opensolaris Sun snv_78 (including) snv_78 (including)
Opensolaris Sun snv_79 (including) snv_79 (including)
Opensolaris Sun snv_80 (including) snv_80 (including)
Opensolaris Sun snv_81 (including) snv_81 (including)
Opensolaris Sun snv_82 (including) snv_82 (including)
Opensolaris Sun snv_83 (including) snv_83 (including)
Opensolaris Sun snv_84 (including) snv_84 (including)
Opensolaris Sun snv_85 (including) snv_85 (including)
Opensolaris Sun snv_86 (including) snv_86 (including)
Opensolaris Sun snv_87 (including) snv_87 (including)
Opensolaris Sun snv_88 (including) snv_88 (including)
Opensolaris Sun snv_89 (including) snv_89 (including)
Opensolaris Sun snv_90 (including) snv_90 (including)
Opensolaris Sun snv_91 (including) snv_91 (including)
Opensolaris Sun snv_92 (including) snv_92 (including)
Solaris Sun 8 (including) 8 (including)
Solaris Sun 9 (including) 9 (including)
Solaris Sun 10 (including) 10 (including)

Extended Description

This can have security implications when the expected synchronization is in security-critical code, such as recording whether a user is authenticated or modifying important state information that should not be influenced by an outsider. A race condition occurs within concurrent environments, and is effectively a property of a code sequence. Depending on the context, a code sequence may be in the form of a function call, a small number of instructions, a series of program invocations, etc. A race condition violates these properties, which are closely related:

A race condition exists when an “interfering code sequence” can still access the shared resource, violating exclusivity. Programmers may assume that certain code sequences execute too quickly to be affected by an interfering code sequence; when they are not, this violates atomicity. For example, the single “x++” statement may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read (the original value of x), followed by a computation (x+1), followed by a write (save the result to x). The interfering code sequence could be “trusted” or “untrusted.” A trusted interfering code sequence occurs within the product; it cannot be modified by the attacker, and it can only be invoked indirectly. An untrusted interfering code sequence can be authored directly by the attacker, and typically it is external to the vulnerable product.

Potential Mitigations

  • Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
  • Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).

References