| Wiki Markup |
|---|
Many programs must address the problem of handling a series of incoming requests. The Thread-Per-Message design pattern is the simplest concurrency strategy, wherein a new thread is created for each request \[[Lea 2000|AA. Bibliography#Lea 00]\]. This pattern is generally preferred to sequential executions of time-consuming, I/O-bound, session-based, or isolated tasks. |
| Wiki Markup |
|---|
However, this pattern also has several pitfalls, including overheads of thread-creation and scheduling, task processing, resource allocation and deallocation, and frequent context switching \[[Lea 2000|AA. Bibliography#Lea 00]\]. Furthermore, an attacker can cause a denial of service by overwhelming the system with too many requests all at once. Instead of degrading gracefully, the system becomes unresponsive, causing a denial of service. From a safety perspective, one component can exhaust all resources because of some intermittent error, starving all other components. |
...
| Wiki Markup |
|---|
According to the Java API documentation for the {{Executor}} interface \[[API 2006|AA. Bibliography#API 06]\]: |
Wiki Markup \[The Interface {{Executor}} is\] An object that executes submitted {{Runnable}} tasks. This interface provides a way of decoupling task submission from the mechanics of how each task will be run, including details of thread use, scheduling, etc. An {{Executor}} is normally used instead of explicitly creating threads.
...
Using simplistic concurrency primitives to process an unbounded number of requests may could result in severe performance degradation, deadlock, or system resource exhaustion and denial of service.
...
Related Vulnerabilities
Related Guidelines
MITRE CWE: CWE-405 "Asymmetric Resource Consumption (Amplification)"
MITRE CWE: CWE-410 "Insufficient Resource Pool"
Bibliography
| Wiki Markup |
|---|
\[[API 2006|AA. Bibliography#API 06]\] [Interface Executor|http://java.sun.com/j2se/1.5.0/docs/api/java/util/concurrent/Executor.html]
\[[Lea 2000|AA. Bibliography#Lea 00]\] Section 4.1.3 Thread-Per-Message and 4.1.4 Worker Threads
\[[Tutorials 2008|AA. Bibliography#Tutorials 08]\] [Thread Pools|http://java.sun.com/docs/books/tutorial/essential/concurrency/pools.html]
\[[Goetz 2006|AA. Bibliography#Goetz 06]\] Chapter 8, Applying Thread Pools
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 405|http://cwe.mitre.org/data/definitions/405.html] "Asymmetric Resource Consumption (Amplification)", [CWE ID 410|http://cwe.mitre.org/data/definitions/410.html] "Insufficient Resource Pool" |
...