openssl / openssl/openssl

Race condition: missing lock protection for dgbl->random_provider read/write (rand_lib.c)

Open
#31,699 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

branch: 3.4 branch: 3.5 branch: 3.6 branch: 4.0 branch: master severity: important triaged: bug
Dominant language
C
Stars
30.8k
Forks
11.5k
Avg merge
10m
Merged PRs (30d)
1

Description

Describe the bug

There is an unsynchronized shared pointer access race condition on dgbl->random_provider inside rand_lib.c.

  1. Write site: ossl_rand_check_random_provider_on_load line 1074
    Direct assignment dgbl->random_provider = prov runs without any mutex lock after an if judgment.
  2. Read site: RAND_bytes_ex line 424
    Direct bare read of dgbl->random_provider without lock protection.

Concurrent multi-thread access leads to TOCTOU race, torn pointer read/write, memory leak, and SIGSEGV crash.

Code snippet
// Line 1074
if (dgbl->random_provider_name == NULL || dgbl->random_provider != NULL)
    return 1;

dgbl->random_provider = prov;  // No lock wrapped

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in rand_lib.c at ossl_rand_check_random_provider_on_load around line 1074 and RAND_bytes_ex around line 424, then inspect how related shared provider state is synchronized. Confirm that concurrent reads and writes to dgbl->random_provider are protected consistently and that the race, invalid pointer access, and leak described in the issue no longer occur.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.