Description
A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch.
This is commonly seen in web browser vulnerabilities in which the attacker can perform certain actions while the browser is transitioning from a trusted to an untrusted domain, or vice versa, and the browser performs the actions on one domain using the trust level and resources of the other domain.
Potential Impact
Integrity, Confidentiality
Modify Application Data, Read Application Data
Detection Methods
- Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea
Real-World CVE Examples
| CVE ID | Description |
|---|---|
| CVE-2009-1837 | Chain: race condition (CWE-362) from improper handling of a page transition in web client while an applet is loading (CWE-368) leads to use after free (CWE-416) |
| CVE-2004-2260 | Browser updates address bar as soon as user clicks on a link instead of when the page has loaded, allowing spoofing by redirecting to another page using onUnload method. ** this is one example of the |
| CVE-2004-0191 | XSS when web browser executes Javascript events in the context of a new page while it's being loaded, allowing interaction with previous page in different domain. |
| CVE-2004-2491 | Web browser fills in address bar of clicked-on link before page has been loaded, and doesn't update afterward. |
Related Weaknesses
Taxonomy Mappings
- PLOVER: — Context Switching Race Condition
Frequently Asked Questions
What is CWE-368?
CWE-368 (Context Switching Race Condition) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the pr...
How can CWE-368 be exploited?
Attackers can exploit CWE-368 (Context Switching Race Condition) to modify application data, read application data. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.
How do I prevent CWE-368?
Follow secure coding practices, conduct code reviews, and use automated security testing tools (SAST/DAST) to detect this weakness early in the development lifecycle.
What is the severity of CWE-368?
CWE-368 is classified as a Base-level weakness (Medium abstraction). It has been observed in 4 real-world CVEs.