Race Condition During Access to Alternate Channel

Draft Base
Structure: Simple
Description

A race condition occurs when an application opens a secondary communication channel intended for an authorized user, but fails to secure it, allowing other actors to potentially access it first.

Extended Description

This vulnerability arises when a system creates an alternate communication path, such as a temporary file, named pipe, or network socket, to exchange data with a legitimate user. Because the system does not properly verify or lock access to this channel immediately upon creation, a window of opportunity opens where an attacker can discover and connect to the channel before the intended user does. Exploiting this race condition allows an attacker to intercept sensitive data meant for the authorized user or inject malicious data into the communication stream. To prevent this, developers must implement atomic operations for channel creation and access, use secure, unpredictable channel identifiers, and enforce strict access controls before any data is transmitted.

Common Consequences 1
Scope: Access Control

Impact: Gain Privileges or Assume IdentityBypass Protection Mechanism

Observed Examples 2
CVE-1999-0351FTP "Pizza Thief" vulnerability. Attacker can connect to a port that was intended for use by another client.
CVE-2003-0230Product creates Windows named pipe during authentication that another attacker can hijack by connecting to it.
References 2
Discovering and Exploiting Named Pipe Security Flaws for Fun and Profit
Blake Watts
04-2002
ID: REF-354
24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, and John Viega
McGraw-Hill
2010
ID: REF-44
Applicable Platforms
Languages:
Not Language-Specific : Undetermined
Modes of Introduction
Architecture and Design
Functional Areas
  1. Program Invocation
Affected Resources
  1. System Process
Taxonomy Mapping
  • PLOVER