Race-Condition Vulnerability Lab
SEED Lab: A Hands-on Lab for Security Education
Overview
The learning objective of this lab is for students to gain the first-hand experience on the race-condition vulnerability by putting what they have learned about the vulnerability from class into actions. A race condition occurs when multiple processes access and manipulate the same data concurrently, and the outcome of the execution depends on the particular order in which the access takes place. If a privileged program has a race-condition vulnerability, attackers can run a parallel process to ``race'' against the privileged program, with an intention to change the behaviors of the program.
In this lab, students will be given a program with a race-condition vulnerability; their task is to develop a scheme to exploit the vulnerability and gain the root privilege. In addition to the attacks, students will be guided to walk through several protection schemes that can be used to counter the race-condition attacks. Students need to evaluate whether the schemes work or not and explain why.
Lab Tasks
- Update Notice: This lab description was newly updated on . If this update happened in the middle of your assignment, you can always get the old version from . The old version will phase out soon.
- VM version: This lab has been tested on our pre-built SEEDUbuntu16.04 VM.
Recommended Time
- Supervised situation (e.g. a closely-guided lab session):
- Unsupervised situation (e.g. take-home project):
Videos (New)
- This topic is covered in my Udemy course: Computer Security: A Hands-on Approach.
Files that are Needed
- vulp.c (the vulnerable program)
Suggested Reading
- SEED Book by Wenliang Du
(Book website)
(Chinese version)