CyberGlossary

Vulnerabilities

Race Condition

Also known as: Concurrency bug, Timing race

Definition

A defect where the security or correctness of a system depends on the timing or ordering of concurrent operations, allowing attackers to interleave actions and bypass checks.

A race condition arises when two or more threads, processes, or actors access shared state without proper synchronisation, so that an attacker can win a timing window to observe partial state or alter it between operations. Security-relevant variants include TOCTOU (check-then-use), atomicity failures in financial logic, and signal-handler reentrancy bugs. Exploitation often requires precise scheduling, ramming the kernel via thread pools, or filesystem tricks (renames, symlinks). Defences include proper locking, transactions, atomic compare-and-swap, file-descriptor based APIs (openat, fstatat), idempotent designs, and tools like ThreadSanitizer and formal concurrency review.

Examples

  • CVE-2016-5195 (Dirty COW) — Linux kernel race condition in COW handling.
  • Filesystem race that lets an attacker replace a file between access() and open().

Related terms