Race condition
Software vulnerability where a program's behavior depends on the unintended ordering or timing of concurrent events. An attacker can exploit it to change system state between a check and its use.
In October 2016, Dirty COW (CVE-2016-5195) exposed a race condition in the Linux kernel's copy-on-write handling, present for years: an unprivileged local user could write to read-only files and get root. A race condition arises when two processes or threads touch a shared resource without proper synchronization, and the outcome depends on the exact order of execution. The classic variant, TOCTOU (time-of-check to time-of-use, CWE-367), splits the check from the use: the program checks a file or its permissions, then opens it, and the attacker swaps the resource in between. The class as a whole has its MITRE entry, CWE-362. The timing attacks Paul Kocher described in 1996, which infer a key from how long a cryptographic operation takes, belong to a different family, side channels, often lumped in with races because time matters in both; the fix there is constant-time code. In decentralized finance, ordering dependence turns into money: MEV searchers (maximal extractable value) exploit the window between a transaction hitting the mempool and its inclusion in a block to cut in front, which is front-running. For insurers and software vendors, a race is hard to spot in static analysis and hard to reproduce in testing. Cyber underwriting questionnaires rarely ask about it, which leaves it an unmeasured residual risk in many financial lines and product liability books.
In 2016, the flaw exploited in The DAO on Ethereum was a race condition: a withdrawal function only updated the balance after sending the funds, so an attacker could call the same function recursively before the update. The attacker drained 60 million dollars in ether, and the chain went through a controversial hard fork to reverse the transaction.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.