CAPEC-25
Alert dla konkretnego CAPEC
Bądź na bieżąco z wszelkimi zmianami dotyczącymi konkretnego CAPEC.
Opisy CAPEC
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.
Informacje CAPEC
Przebieg wykonania
1) Explore
The adversary initiates an exploratory phase to get familiar with the system.
2) Explore
The adversary triggers a first action (such as holding a resource) and initiates a second action which will wait for the first one to finish.
3) Explore
If the target program has a deadlock condition, the program waits indefinitely resulting in a denial of service.
Wymagania wstępne
The target host has a deadlock condition. There are four conditions for a deadlock to occur, known as the Coffman conditions. [REF-101]The target host exposes an API to the user.
Wymagane umiejętności
This type of attack may be sophisticated and require knowledge about the system's resources and APIs.Łagodzenie
Use known algorithm to avoid deadlock condition (for instance non-blocking synchronization algorithms).For competing actions, use well-known libraries which implement synchronization.
Powiązane słabości
| Nazwa słabości | |
|---|---|
CWE-412 |
Unrestricted Externally Accessible Lock The product properly checks for the existence of a lock, but the lock can be externally controlled or influenced by an actor that is outside of the intended sphere of control. |
CWE-567 |
Unsynchronized Access to Shared Data in a Multithreaded Context The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes. |
CWE-662 |
Improper Synchronization The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes. |
CWE-667 |
Improper Locking The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors. |
CWE-833 |
Deadlock The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock. |
CWE-1322 |
Use of Blocking Code in Single-threaded, Non-blocking Context The product uses a non-blocking model that relies on a single threaded process for features such as scalability, but it contains code that can block when it is invoked. |
Odniesienia
REF-1
Exploiting Software: How to Break CodeG. Hoglund, G. McGraw.
REF-101
Wikipediahttp://en.wikipedia.org/wiki/Deadlock
REF-609
OWASP Web Security Testing Guidehttps://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/07-Testing_for_XML_Injection.html
Zgłoszenie
| Nazwa | Organizacja | Data | Data wydania |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation |
Modyfikacje
| Nazwa | Organizacja | Data | Komentarz |
|---|---|---|---|
| CAPEC Content Team | The MITRE Corporation | Updated Related_Attack_Patterns, Type (Relationship -> Attack_Pattern) | |
| CAPEC Content Team | The MITRE Corporation | Updated Activation_Zone, Attack_Motivation-Consequences, Attack_Phases, Description Summary, Injection_Vector, Payload, Payload_Activation_Impact, Probing_Techniques, Related_Weaknesses, Solutions_and_Mitigations | |
| CAPEC Content Team | The MITRE Corporation | Updated References, Solutions_and_Mitigations | |
| CAPEC Content Team | The MITRE Corporation | Updated Prerequisites | |
| CAPEC Content Team | The MITRE Corporation | Updated References, Related_Weaknesses | |
| CAPEC Content Team | The MITRE Corporation | Updated Taxonomy_Mappings |
