Security Fix: Race Condition + NPE
ShellSubscriber is lazily initialized, and multiple threads can attempt to write the same pointer since it is not initialized in threadsafe code. Additionally, there is an NPE that crashes statsd when a null ResultReceiver is passed in, which allows an attacker to repeatedly crash statsd until the race condition occurs. More details, including a proof of concept attack, are in the bug. Bug: 141243101 Test: repro steps in bug no longer crash statsd Test: with only the lock on iniitiallizing mShellSubscriber, statsd still crashed but after ~7 minutes, no race condition occurred. Change-Id: Ib56f888620497fb41d1627c07867693eb251738e
Loading
Please register or sign in to comment