普遍的弱点

While sometimes intentional and safe, when the same function is used to handle multiple signals, a race condition could occur if the function uses any state outside of its local declaration, such as global variables or non-reentrant functions, or has any side effects.

An attacker could send one signal that invokes the handler function; in many OSes, this will typically prevent the same signal from invoking the handler again, at least until the handler function has completed execution. However, the attacker could then send a different signal that is associated with the same handler function. This could interrupt the original handler function while it is still executing. If there is shared state, then the state could be corrupted. This can lead to a variety of potential consequences depending on context, including denial of service and code execution.

Another rarely-explored possibility arises when the signal handler is only designed to be executed once (if at all). By sending multiple signals, an attacker could invoke the function more than once. This may generate extra, unintended side effects. A race condition might not even be necessary; the attacker could send one signal, wait until it is handled, then send the other signal.

示例1

该代码用两个不同的信号注册相同的信号处理程序功能。

示例2

该代码用两个不同的信号注册相同的信号处理程序功能（CWE-831）。如果将这些信号发送到该过程，则处理程序将创建一个日志消息（在第一个参数中指定为程序）并退出。

处理程序函数使用全局状态（GlobalVar和LogMessage），并且可以通过Sighup和Sigment信号调用。攻击方案可能会遵循以下界限：

• The program begins execution, initializes logMessage, and registers the signal handlers for SIGHUP and SIGTERM.
• 该程序开始其“正常”功能，该功能被简化为Sleep（），但可能是任何会消耗一段时间的功能。
• The attacker sends SIGHUP, which invokes handler (call this "SIGHUP-handler").
• Sighup Handler开始执行，调用Syslog（）。
• syslog（）呼叫malloc（），它是非诱饵的。malloc（）开始修改元数据以管理堆。
• The attacker then sends SIGTERM.
• Sighup Handler被打断了，但是Syslog的Malloc电话仍在执行，尚未完成修改其元数据。
• 调用Sigterm处理程序。
• SIGTERM HANDLER使用Syslog（）记录日志消息，然后释放LogMessage变量。

At this point, the state of the heap is uncertain, because malloc is still modifying the metadata for the heap; the metadata might be in an inconsistent state. The SIGTERM-handler call to free() is assuming that the metadata is inconsistent, possibly causing it to write data to the wrong location while managing the heap. The result is memory corruption, which could lead to a crash or even code execution, depending on the circumstances under which the code is running.

请注意，这是Michal Zalewski最初提出的经典示例的改编[Ref-360]; the original example was shown to be exploitable for code execution.

另请注意，strdup（argv [1]）呼叫包含一个潜在的缓冲区过读（CWE-126) if the program is called without any arguments, because argc would be 0, and argv[1] would point outside the bounds of the array.