#racecondition — Public Fediverse posts

In today’s programming workshop for @coocook we’ve fixed a long-standing bug in the ingredients editor (image 1):

When you added ingredients to recipes there was a #RaceCondition. The new ingredient is always added to the database but SOMETIMES the view was updated before so the new ingredient wasn’t visible until next reload …

It was a nice engineering challenge to reproduce this issue reliably. Slowing down the connection did not help. Making any of the requests respond slower did not help. Using the #Starman application server for #Perl instead of the single-threaded dev server finally allowed to reproduce the issue 😅

The actual bug was in the #reactjs app: Requests for adding the new ingredient and updating the view were fired but the keyword "await" was missing to actually wait for the response 🙈 (image 2)

https://gitlab.com/coocook/web-components/-/commit/ca2b23914c59f71a3f11618d9328684480a0b778

race conditions are so annoying to debug. You can have a good reproduction setup, but the moment you change logs, it fails to trigger the bug.

#racecondition #debugging #workposting

@eliocamp @diazona

It's a race condition. We normally think of races in terms of racing against yourself - one part of the code does something, while another thread does something else that can cause problems if the timing lines up "right".

But it's still a race condition if the problematic action is caused by something else - a different program, a user's ill-timed command, etc.

Handling these sorts of things requires defensive programming and/or a lot of code for gracefully falling back. This is the sort of code that tends to accumulate in codebases over time, as edge cases are slowly and painfully found and worked around. It's also the kind of knowledge that doesn't exist in the original spec document, which is why ground-up rewrites of established systems tend to fail in ways that the original system experienced and fixed years before.

The Rust rewrite of coreutils exposed a bunch of exactly this kind of failure-to-understand why the original system was operating in the way it did, rather than the "obvious, correct, simple" way.

#CoreUtils #rewrite #SecondSystem #race #RaceCondition #TOCTTOU #EmbeddedKnowledge

Wenn du in Java zum ersten Mal über Konkurrenz und Threads stolperst, wirkt das Thema schnell größer, als es eigentlich sein muss. Das liegt vor allem daran, dass mehrere Begriffe durcheinandergeworfen werden. Mal ist von Parallelität die Rede, mal von Nebenläufigke...

https://magicmarcy.de/konkurrenz-und-threads-in-java-einfach-erklaert

#Threads #Java #Aufgaben #Coding #Konkurrenz #Nebenläufigkeit #Programming #Executor #Parallelität #RaceCondition #Prozesses #Speicher #ExecutorService

Wow so it turns out I was right, Javascript is a gross language that is impossible to read for anybody who isn't already familiar with its syntax.

I come from C/C++ and Python land when it comes to network request stuff, and I'm accustomed to code just executing one line after another. I can get used to the async stuff, but it's pretty damn frustrating that VS Code doesn't even have any indications to tell you when a function is going to be async or not.

There's also seemingly no immediately clean way to just say "don't continue, everything after this is going to rely on the result of this function".

Maybe I'm just bitching because I don't understand how await and Promises work.

#webdev #JS #html #async #raceCondition #programming

Knock knock
Race condition
Who’s there?

(Credit: Ian Coldwater)

#Dev #Development #Jokes #RaceCondition

How to Stop Double Writes With INSERT Then UPDATE

Race conditions can create duplicate rows.

#mysql #upsert #racecondition #howto #duplicates #concurrency

https://www.youtube.com/watch?v=_yRoFSaJ8h0

Here is a blog entry describing how the good old deposit/withdraw #RaceCondition occurred in real life. As many lecturers, I use this example in my lectures, so next time this gives me an opportunity to talk about the ethical aspects of such a discovery.

https://blog.z.org/the-day-the-house-lost/

Watching #claude troubleshoot a #racecondition between #docker Containers is really fun to watch as the Code behaves Different every time it's run

"the REAL issue is..."

🤣🤣🤣

#vibecoding #AI #ki #grok #copilot #gemini #sloperator

Oto błąd, który pozwalał za darmo zamawiać jedzenie z cateringu “Kuchnia Vikinga” i z jeszcze jednego

Istotne błędy bezpieczeństwa można znaleźć nawet jeśli nie jest się zawodowym pentesterem. Przekonał się o tym nasz Czytelnik Tomek Stojanov, który przekonał aplikację do zamawiania dietetycznego cateringu by w nieskończoność zwiększała mu saldo. Tomek to jednak uczciwy klient, więc postanowił błąd ujawnić. I dobrze się stało, bo – jak wykazała analiza – z tego samego błędu korzystał ktoś jeszcze. Już nie taki etyczny.
Chcecie darmowy obiad, śniadanie i kolację od Vikinga?
W połowie listopada do naszej redakcji zgłosił się Tomek, który nie jest ani programistą ani specjalistą od bezpieczeństwa, ale jest człowiekiem spostrzegawczym. W czasie korzystania z aplikacji cateringu dietetycznego o nazwie “Kuchnia Vikinga” zauważył coś dziwnego… Aplikacja pozwalała na złożenie zamówienia i anulowanie go. Po anulowaniu użytkownikowi naliczały się punkty lojalnościowe o równowartości kwoty zamówienia. Punkty mogły być wykorzystywane do opłacenia kolejnych zamówień. I teraz ważna rzecz:
Proces anulowania trochę trwał, a użytkownik mógł w trakcie tego “trwania” anulować dostawę po raz kolejny. I kolejny. I kolejny, zanim to pierwsze anulowanie dobiegło końca.
Poniżej film z akcji nagrany przez Tomka:

Błąd jak widzicie poważny. Mógł powodować straty finansowe po stronie dostawcy cateringu.
Tomek błąd chciał zgłosić, ale miał z tym problem…
Odezwał się do firmy MasterLife Solutions, która jest dostawcą aplikacji mobilnej dla Kuchni Vikinga. Ta odesłała go do serwisu Intigriti (służącego do obsługi zgłoszeń typu bug bounty), który dla osoby [...]

#Aplikacje #Żabka #CateringDietetyczny #Intigriti #KuchniaVikinga #MasterLifeSolutions #RaceCondition #TomekStojanov

https://niebezpiecznik.pl/post/oto-blad-ktory-pozwalal-za-darmo-zamawiac-jedzenie-z-cateringu-kuchnia-vikinga-i-z-jeszcze-jednego/

🎉 Wow, someone found a "race condition" in Aurora RDS! 🚀 Meanwhile, #Hightouch is busy throwing buzzwords at us like confetti at a tech wedding—Composable CDP! Reverse ETL! ISO 27001! 🤯 But apparently, AI can understand your brand now...so maybe it can explain what "race condition" means while it's at it? 🙄
https://hightouch.com/blog/uncovering-a-race-condition-in-aurora-rds #racecondition #AuroraRDS #ComposableCDP #AIunderstanding #techbuzzwords #HackerNews #ngated

We Uncovered a Race Condition in Aurora RDS

https://hightouch.com/blog/uncovering-a-race-condition-in-aurora-rds

#HackerNews #RaceCondition #AuroraRDS #TechNews #CyberSecurity #CloudComputing #DatabaseManagement

Gestion des accès concurrents en Node.js à l'aide d'un mutex, entre autres.

Et oui, le fait que Node tourne sur un seul thread n'empêche pas les *race conditions*.

🔗 https://nodejsdesignpatterns.com/blog/node-js-race-conditions/

#NodeJS #racecondition #concurrence

I feel like the US – in terms technical folk would understand – is in a #raceCondition.

It's a question of whether the pain caused by a collapsing health/social system and the explosion of consumer prices due to irrational tariffs will cause an dethroning uprising before the authoritarianism goes into full martial-law mode.

#uspoli

CVE-2020-27786 ( Race Condition + Use-After-Free ):

https://ii4gsp.github.io/cve-2020-27786/

#cve #uaf #cybersecurity #exploitation #infosec #exploit #racecondition #vulnerability

RHEL 9 OpenSSH packages affected by remote code execution flaw

https://stackdiary.com/rhel-9-openssh-packages-affected-by-remote-code-execution-flaw/

#OpenSSH #Vulnerability #RHEL9 #Security #CyberSecurity #CVE20246409 #RemoteCodeExecution #Linux #Fedora #RaceCondition #SIGALRM #Exploit #PatchManagement #Mitigation #Infosec #Threat #Hackers #Bug #Malware #Glitch #Audit #Syslog #Update #Enterprise #LinuxSecurity #NetworkSecurity #ServerSecurity #CyberThreat #SystemAdmin #TechNews #CVE #Mitre #NIST #OpenSource #DevOps #regreSSHion

Found a #racecondition in a productivity tool for teams limits the number of members a team can have depending on the paid plan. I managed to bypass that limit and have many more users (than the imposed limit) join the same team. 🎉

#bugbounty #hacking #cybersecurity

The current #OpenSSH #racecondition #vulnerability PoC exploit depends on bruteforcing the Address Space Layout Randomization (ASLR) to guess addresses used by the sshd. Thus #exploitation currently appears feasible only if the ASLR entropy is low enough (platforms with 32-bit addressing or systems where ASLR is for some reason completely disabled). Of course this is something you should not rely on and patching is highly recommended as soon as possible.

If for some reason you need to mitigate the vulnerability on systems that don't have security updates or the updates are delayed you can apply the mitigations from the excellent post from Damien Miller at oss-security mailing list: https://www.openwall.com/lists/oss-security/2024/07/01/2

regreSSHion: Remote Code Execution in OpenSSH Server (CVE-2024-6387)

Date: July 1, 2024

CVE: CVE-2024-6387

Vulnerability Type: Race Condition

CWE: [[CWE-362]], [[CWE-665]]

Sources: Qualys

Synopsis

A critical remote code execution (RCE) vulnerability has been identified in OpenSSH's server on glibc-based Linux systems, allowing unauthenticated attackers to execute arbitrary code as root.

Issue Summary

The vulnerability, identified as CVE-2024-6387, is a regression of a previously patched issue (CVE-2006-5051) and affects OpenSSH versions from 8.5p1 to 9.8p1. It arises from a signal handler race condition in the sshd server, leading to unsafe function calls within asynchronous signal handlers.

Technical Key Findings

The flaw involves sshd's SIGALRM handler, which calls non-async-signal-safe functions like syslog(), potentially leading to a heap corruption and enabling remote code execution. The exploit requires precise timing to interrupt specific code paths, leaving the system in an inconsistent state that can be exploited.

Vulnerable Products

• OpenSSH versions 8.5p1 to 9.8p1 on glibc-based Linux systems.

Impact Assessment

Exploitation of this vulnerability allows an attacker to execute arbitrary code as root on affected systems, potentially leading to complete system compromise.

Patches or Workaround

A fix has been implemented in OpenSSH by moving the async-signal-unsafe code to a synchronous context. Users are advised to update to the latest version or set LoginGraceTime to 0 as a temporary mitigation.

Tags

#OpenSSH #CVE-2024-6387 #RCE #RaceCondition #Linux #glibc #SecurityVulnerability #Exploit #Patch

everyday you #racecondition is a good day. find and solve a

Die Ursache dafür war eine Exception, die im Code geworfen wurde, der nach den Tests ausgeführt wurde. Das ist der Grund für das falsche Zählen: Die Tests wurde korrekt ausgeführt, es kam aber danach zu einem Fehler.

Der Grund dafür war eine #RaceCondition, die wiederum verursacht wurde durch ein fehlendes #await Schlüsselwort.

Kurzgesagt: Es läuft jetzt ohne Probleme. Das Finden der Ursache hat ca. 90 Minuten Aufwand mit sich gebracht.

#JS #AsyncProgramming

The Other Kind Of Static Hazard to Your Logic Circuits - We’ve all heard of the dangers of static electricity when dealing with electronics... - https://hackaday.com/2023/11/24/the-other-kind-of-static-hazard-to-your-logic-circuits/ #racecondition #truthtable #mischacks #implicant #boolean #k-table #static #logic #gate #and #not #ttl #or

@regehr the race conditions in #Scratch were the reason why my daughter gave up on it. She ran into weird behavior and asked me to fix it. But I couldn’t. On the positive side: Even at #MIT they cook with water. And it seems some #drunkenlemurs work there, too.

#RaceCondition

This is exactly what #GNOME #Calendar felt like to me. Great if they are getting closer to fix it. #heisenbug #raceCondition

https://mastodon.social/@nekohayo/110939643457489280

Using the readlink function to avoid symbolic link race conditions when opening a file path

https://security.stackexchange.com/questions/268016/using-the-readlink-function-to-avoid-symbolic-link-race-conditions-when-opening

#racecondition #linux #c

#Teammates past and present confirmed the solution to my #rbac #racecondition woes. Got it implemented, got the #operator installed in the #kubernetes cluster, and got that first line-of-business #workload deployed via its pipeline, without any modifications from developers.

Tomorrow we try to get the other 80+ workloads deployed into that cluster. Automator gonna #automate.

But for now, there is #soup. Tasty, comforting soup on a chilly day.