24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them

SIN 13RACE CONDITIONS

OVERVIEW OF THE SIN

The definition of a race condition is when two different execution contexts, whether they are threads or processes, are able to change a resource and interfere with one another. The typical flaw is to think that a short sequence of instructions or system calls will execute atomically, and that there’s no way another thread or process can interfere. Even when they’re presented with clear evidence that such a bug exists, many developers underestimate its severity. In reality, most system calls end up executing many thousands (sometimes millions) of instructions, and often they won’t complete before another process or thread gets a time slice.

Although we can’t go into detail here, a simple race condition ...