Comprehensible race conditions bugs resulting in security flaws

Viewed 83


I am looking for famous, easy and real-life security flaws (preferredly in C/C++, but not necessarily) that result from race conditions.
So far I only found somewhat comprehensible, accessible and dangerous flaws in the glibc (setuid) and the Linux kernel, both of which are probably too complex as triggering them would result in a long and possibly boring demonstration. In addition, I found database race conditions, which are probably more useful but off-context.

They already got a few small programs where race conditions occur, but only because of manual sleep() calls.
The question boils down to this:

Are there any well-known race conditions in C or C++ that occured in the wild and are dangerous in a security context?

Context: Showing how Concurrency can become dangerous in real-life examples. Target audience are experienced C/C++ programmers who didn't think much about Concurrency beforehand.

Thank you for your time.

1 Answers

I remember reading in a book somewhere about a race condition problem with X11 that creates a file in /tmp, and there was a security flaw because one could change the content of the file between the time it was created and the time it was accessed. Not sure but I think it was this one: https://bugzilla.redhat.com/show_bug.cgi?id=988498

Related