1

A race condition occurs when two or more threads access shared data and try to do so at the same time.

The Heartbleed attack is a vulnerability in OpenSSL, where a Client sends heartbeat requests to a Server. The heartbeat requests can be of variable length, the length of the request is specified, however not checked for. Therefore when manipulating the size field of the heartbeat request, the server would return a reply that could be very long and therefore contain security relevant information.

Now, how on earth is this vulnerability related to two threads trying to access shared data at the same time? This question has been asked in one of our previous exams and I really cannot answer this. Can somebody help?

Also, very much related to this question is the following: Can type-safety prevent race-conditions? Type-safety basically means: The programmer is no longer in charge of memory management. And since race-conditions arise whenever two or more threads are trying to access shared memory, type-safety provides a way to at least minimize race-conditions, doesn't it?

Improve this question
7
  • have you read the CVEs?
    – schroeder ♦
    Commented Feb 20, 2019 at 17:15
  • No. But I think the basic idea gets across pretty good in this little presentation: imada.sdu.dk/~jamik/dm557-16/material/recent-issues.pdf
    – user503842
    Commented Feb 20, 2019 at 17:29
  • 2
    @user503842: a race condition is a condition which only happens when some more or less random conditions align with each other. This can happen with threads but can happen also without threads, for example if specific access pattern cause a specific memory layout. And specific memory layout is needed in order for heartbleed to leak not only memory but memory containing sensitive data (like the private key).
    – Steffen Ullrich
    Commented Feb 20, 2019 at 17:39
  • 1
    @user503842: There are different levels of type-safety, some would have prevented this error (when the type-safety is strong enough to result in memory-safety) while others not. See also wikipedia.
    – Steffen Ullrich
    Commented Feb 20, 2019 at 18:15
  • 1
    Where are you getting that this is a race condition? The only thing I see in the descriptions (here's a detailed one) indicate it's a bounds checking issue. The presentation you provide says only mentions a race condition in relation to 'dirty cow'.
    – JimmyJames
    Commented Feb 20, 2019 at 19:24

1 Answer 1

Reset to default
6

Heartbleed was not an exploitation of a race condition... though you could argue the non-deterministic nature of the data returned is an outcome of a race condition. The exploit was a case of improperly placed trust (and improper bounds checking). The victim trusted the attacker to tell it how large it's heartbeat response payload should be (because the server code was written to write a response of the same length (asserted length via the payload_length field)).

In heartbleed the "hacker" sends a four-byte HeartbeatMessage with a 1 byte payload. this is the normal/correct length but the "hacker" claims the payload is huge in the payload_length field... lets say 65535 bytes in size. The victim reads 65535 bytes from its memory (instead of the 1 byte is should read). This read starts from the received HeartbeatMessage payload. It thus sends far more data than it should, leaking potentially useful/dangerous information.

Using the above a "hacker" can repeat this process as often as they like to try to find juicy info from a target.

Improve this answer
9
  • 2
    Yep. It seems like OP already knows how heartbleed works, they just can't figure out how race conditions are related. If they're not related, then that's the real answer. Although, while I wouldn't think of it as a race condition myself, based on Steffen's comment and wikipedia's definition of "race condition" I think you could consider the leaking of sensitive data a race condition.
    – AndrolGenhald
    Commented Feb 20, 2019 at 21:05
  • @AndrolGenhald ah thanks. I guess I didn't read the question carefully enough...the title just triggered me :)
    – DarkMatter
    Commented Feb 20, 2019 at 21:16
  • @AndrolGenhald Can you explain how this issue can be described as a 'race condition'? Let's start with the first sentence from the Wikipedia page for Race Condition: "... where the system's substantive behavior is dependent on the sequence or timing of other uncontrollable events." I don't see how this can be fit into that definition. It's not related to sequencing events and timing is not relevant. There's uncontrolled here. I really think this is the right answer. It's not a race condition at all.
    – JimmyJames
    Commented Feb 20, 2019 at 21:39
  • @AndrolGenhald Errata: There's uncontrolled here -> There's nothing uncontrolled here
    – JimmyJames
    Commented Feb 20, 2019 at 21:45
  • @JimmyJames The data that is leaked is uncontrolled. It could be 64kb of 0s, or it could be the private key to the site's TLS certificate. But I'd agree it's not really how most people would categorize it.
    – AndrolGenhald
    Commented Feb 20, 2019 at 21:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .