| 名称 |
Forced Deadlock |
|
|
| 摘要 |
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect. |
| 前置条件 |
The target host has a deadlock condition. There are four conditions for a deadlock to occur, known as the Coffman conditions. [REF-101] The target host exposes an API to the user. |
| 执行流程 |
| 步骤 |
阶段 |
描述 |
技术手法 |
| 1 |
Explore |
The adversary initiates an exploratory phase to get familiar with the system. |
|
| 2 |
Explore |
The adversary triggers a first action (such as holding a resource) and initiates a second action which will wait for the first one to finish. |
|
| 3 |
Explore |
If the target program has a deadlock condition, the program waits indefinitely resulting in a denial of service. |
|
|
| 解决方案 | Use known algorithm to avoid deadlock condition (for instance non-blocking synchronization algorithms). For competing actions, use well-known libraries which implement synchronization. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-412 |
Unrestricted Externally Accessible Lock |
| CWE-567 |
Unsynchronized Access to Shared Data in a Multithreaded Context |
| CWE-662 |
Improper Synchronization |
| CWE-667 |
Improper Locking |
| CWE-833 |
Deadlock |
| CWE-1322 |
Use of Blocking Code in Single-threaded, Non-blocking Context |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1499.004 |
Endpoint Denial of Service: Application or System Exploitation |
|