Page History

The Many programs must address the problem of handling a series of incoming requests. One simple concurrency strategy is the Thread-Per-Message design is the simplest concurrency technique wherein a thread is created for each incoming request. The benefits of creating a new thread to handle each request should outweigh the corresponding thread creation overheads. This design is generally recommended over sequential executions for time pattern, which uses a new thread for each request [Lea 2000a]. This pattern is generally preferred over sequential executions of time-consuming, I/O-bound, session-based, or isolated tasks.

On the other hand, there can be several disadvantages of this design such as thread creation overhead in case of frequent or recurring requests, significant processing overhead, resource exhaustion of threads (leading to {{OutOfMemoryError}}), thread scheduling and context switching overhead \[[Lea 00|AA. Java References#Lea 00]\].   

An attacker can cause a denial of service However, the pattern also introduces overheads not seen in sequential execution, including the time and resources required for thread creation and scheduling, for task processing, for resource allocation and deallocation, and for frequent context switching [Lea 2000a]. Furthermore, an attacker can cause a denial of service (DoS) by overwhelming the system with too many requests , all at once. Instead of degrading gracefully, causing the system goes down abruptly, resulting in an availability issue. Thread pools allow the system to service as many requests as it can comfortably sustain, instead of stopping all services when faced to become unresponsive rather than degrading gracefully. From a safety perspective, one component can exhaust all resources because of an intermittent error, consequently starving all other components.

Thread pools allow a system to limit the maximum number of simultaneous requests that it processes to a number that it can comfortably serve rather than terminating all services when presented with a deluge of requests. From the safety point of view, it is possible for one component to exhaust all resources because of some intermittent error, starving all others from using them.Thread Pools Thread pools overcome these issues as by controlling the maximum number of worker threads that can be initiated and executed simultaneously can be suitably controlled. Every worker accepts a Runnable object from a request execute concurrently. Each object that supports thread pools accepts a Runnable or Callable<T> task and stores it in a temporary Channel like a buffer or a queue until resources become available. Because threads are Additionally, thread life-cycle management overhead is minimized because the threads in a thread pool can be reused and can be efficiently added to the Channel, most of the thread creation overhead is also eliminatedor removed from the pool.

Programs that use multiple threads to service requests should—and programs that may be subjected to DoS attacks must—ensure graceful degradation of service during traffic bursts. Use of thread pools is one acceptable approach to meeting this requirement.

Noncompliant Code Example (Thread-Per-Message)

This noncompliant code example demonstrates the Thread-Per-Message design that fails to provide graceful degradation of servicepattern. The RequestHandler class provides a public static factory method so that callers can obtain a RequestHandler instance. The handleRequest() method is subsequently invoked to handle each request in its own thread.

class Helper {
  public void handle(StringSocket requestsocket) {
    // ... 		
  }	
}

final class GetRequestRequestHandler {
  protectedprivate final Helper hhelper = new Helper();
  private final StringServerSocket requestserver;

  public synchronized String accept()private RequestHandler(int port) throws IOException {
    Stringserver data = "Read data from pipe"new ServerSocket(port);
  }

  //public Readstatic theRequestHandler request data, else blocknewInstance() throws IOException {
    return data; new RequestHandler(0); // Selects next available port
  }

  public void requesthandleRequest() {
    while(true new Thread(new Runnable() {
        requestpublic =void acceptrun();
 {
          try {
          new  Thread(new Runnable() {
helper.handle(server.accept());
          public} voidcatch run(IOException e) {
          h.handle(request);  // Forward to handler
          }
        }
    }).start();
    }
  }
}

The thread-per-message strategy fails to provide graceful degradation of service. As threads are created, processing continues normally until some scarce resource is exhausted. For example, a system may allow only a limited number of open file descriptors even though additional threads can be created to serve requests. When the scarce resource is memory, the system may fail abruptly, resulting in a DoS.

Compliant Solution

...

This compliant solution uses a _Fixed Thread Pool_ that places an upper bound on the number of simultaneously executing threads. Tasks submitted to the pool are stored in an internal queue. This prevents the system from getting overwhelmed when trying to respond to all incoming requests and allows it to degrade gracefully by serving a fixed number of clients at a particular time. \[[Tutorials 08|AA. Java References#Tutorials 08]\]

According to the Java API \[[API 06|AA. Java References#API 06]\] documentation for the {{Executor}} interface:

Wiki Markup
\[The Interface {{Executor}} is\] An object that executes submitted {{Runnable}} tasks. This interface provides a way of decoupling task submission from the mechanics of how each task will be run, including details of thread use, scheduling, etc. An {{Executor}} is normally used instead of explicitly creating threads.

(Thread Pool)

This compliant solution uses a fixed thread pool that places a strict limit on the number of concurrently executing threads. Tasks submitted to the pool are stored in an internal queue. Storing tasks in a queue prevents the system from being overwhelmed when attempting to respond to all incoming requests and allows it to degrade gracefully by serving a fixed maximum number of simultaneous clients [Java Tutorials].

// class Helper remains unchanged

final class RequestHandler {
  private final Helper helper

class GetRequest {
  protected final Helper h = new Helper();
  String request;

  public synchronized String accept() {private final ServerSocket server;
  private final String data = "Read data from pipe";ExecutorService exec;

  private  // Read the request data, else blockRequestHandler(int port, int poolSize) throws IOException {
    returnserver data;
=  }

  public void request() {
    int NoOfThreads = 200new ServerSocket(port);
    Executor exec = (Executor) Executors.newFixedThreadPool(NoOfThreadspoolSize);
    while(true) {
      request = accept();}

  public static RequestHandler  exec.execute(new Runnable(newInstance(int poolSize) {
        public void run() {
          h.handle(request);
        }
      });
    }
  }
}

Noncompliant Code Example

In reality, there are some problems associated with the use of the Executor interface. For one, tasks that depend on other tasks should not execute in the same Thread Pool. A task that submits another task to a single threaded Executor remains blocked until the results are received whereas the second task waits until the first one has concluded. This constitutes a deadlock.

...

...

...

throws 

...

IOException 

...

{
 

...

...

...

...

return 

...

class NetworkServer extends InitialHandshake implements Runnable {
  private final ServerSocket serverSocket;
  private final ExecutorService pool;

  public NetworkServer(int port, int poolSize) throws IOException {
    serverSocket = new ServerSocket(portnew RequestHandler(0, poolSize);
  }

  public void handleRequest() {
    Future<?> future = exec.submit(new Runnable() {
        @Override public void run() {
          try {
            helper.handle(server.accept());
    pool = Executors.newFixedThreadPool(poolSize);
  }
 
 } publiccatch void(IOException run(e) {
    try { 
      // Forward Interdependentto taskshandler
      pool.submit(new SanitizeInput(password));  // Password}
 is defined in class InitialHandshake
   }
   pool.submit(new CustomHandshake(password)); });
  }
  // for e..g. clientOther puzzlesmethods 
such as shutting down the thread pool.execute(new Handle(serverSocket.accept())); 
  // Handleand connection
task    } catch (IOException ex) { 
      pool.shutdown();
    }	 
  }cancellation ...
}

Compliant Solution

Always try to submit independent tasks to the Executor. Choosing a large pool size can also help reduce thread starvation problems. Note that any operation that has further constraints, such as the total number of database connections or total ResultSets open at a particular time, impose an upper bound on the Thread Pool size as each thread continues to block until the resource becomes available. The other rules of fair concurrency, such as not running response sensitive tasks, also apply.

Sometimes, a {{private static}} {{ThreadLocal}} variable is used per thread to maintain local state. With Thread Pools, these should be employed only if their lifetime is shorter than that of the corresponding task \[[Goetz 06|AA. Java References#Goetz 06]\]. Moreover, such variables should not be used as a communication mechanism between tasks. Finally, the choice of the unbounded  {{newFixedThreadPool}} may not always be the best. Refer to the API documentation for choosing between the former, {{newCachedThreadPool}}, {{newSingleThreadExecutor}} and {{newScheduledThreadPool}} to suit the design requirements.

This compliant solution recommends executing the interdependent tasks as a single task within the Executor. In other cases, where the subtasks do not require concurrency safeguards, the subtasks can be moved outside the threaded region that is going to be executed by the Executor.

...

...

According to the Java API documentation for the Executor interface [API 2014]:

[The interface Executor is] an object that executes submitted Runnable tasks. This interface provides a way of decoupling task submission from the mechanics of how each task will be run, including details of thread use, scheduling, etc. An Executor is normally used instead of explicitly creating threads.

The ExecutorService interface used in this compliant solution derives from the java.util.concurrent.Executor interface. The ExecutorService.submit() method allows callers to obtain a Future<V> object. This object both encapsulates the as-yet unknown result of an asynchronous computation and enables callers to perform additional functions such as task cancellation.

The choice of newFixedThreadPool is not always appropriate. Refer to the Java API documentation [API 2014] for guidance on choosing among the following methods to meet specific design requirements:

• newFixedThreadPool()
• newCachedThreadPool()
• newSingleThreadExecutor()
• newScheduledThreadPool()

Risk Assessment

Using simplistic concurrency primitives (often incorrectly too) may lead to to process an unbounded number of requests could result in severe performance degradation, deadlocks and starvation deadlock, or exhaustion of system resources. This results in a denial-of-service attack.system resource exhaustion and DOS.

Automated Detection

...

TODO

Related Vulnerabilities

Apache Geronimo 3838

References

\[[API 06|AA. Java References#API 06]\] [Interface Executor|http://java.sun.com/j2se/1.5.0/docs/api/java/util/concurrent/Executor.html]
\[[Lea 00|AA. Java References#Lea 00]\] Section 4.1.3 Thread-Per-Message and 4.1.4 Worker Threads
\[[Tutorials 08|AA. Java References#Tutorials 08]\] [Thread Pools|http://java.sun.com/docs/books/tutorial/essential/concurrency/pools.html]
\[[Goetz 06|AA. Java References#Goetz 06]\] Chapter 8, Applying Thread Pools
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 405|http://cwe.mitre.org/data/definitions/405.html] "Asymmetric Resource Consumption (Amplification)", [CWE ID 410|http://cwe.mitre.org/data/definitions/410.html] "Insufficient Resource Pool"

Sound automated detection is infeasible; heuristic checks could be useful.

Tool	Version	Checker	Description
Parasoft Jtest	Include Page Parasoft_V Parasoft_V	CERT.TPS00.ISTART	Do not call the 'start()' method directly on Thread class instances

Related Guidelines

Bibliography

...

Image Added Image Added Image AddedCON20-J. Never apply a lock to methods making network calls      11. Concurrency (CON)      CON22-J. Do not use incorrect forms of the double-checked locking idiom