SV.PIPE.VAR
Potential pipe hijacking in variable
If the FILE_FLAG_FIRST_PIPE_INSTANCE parameter isn't used in the CreateNamedPipe function, the pipe can be created over an existing file, allowing a malicious user to obtain security-sensitive data or possibly execute arbitrary commands.
The SV.PIPE.VAR checker finds instances in which the CreateNamedPipe function is used with a variable instead of the FILE_FLAG_FIRST_PIPE_INSTANCE parameter.
Vulnerability and risk
Named pipes and shared files can compromise the system and allow unauthorized users to obtain user names of legitimate users or other sensitive information. The primary risk from this vulnerability is that a malicious user could gain additional privileges and hijack the pipe to run arbitrary programs.
Mitigation and prevention
Using the FILE_FLAG_FIRST_PIPE_INSTANCE flag as the second argument in CreateNamedPipe protects against pipe highjacking attacks by ensuring that the pipe you're creating hasn't already been created.
Vulnerable code example
hPipe = CreateNamedPipe(
lpszPipename, // pipe name
mode, // read/write access
PIPE_TYPE_MESSAGE | // message type pipe
PIPE_READMODE_MESSAGE | // message-read mode
PIPE_WAIT, // blocking mode
PIPE_UNLIMITED_INSTANCES, // max. instances
BUFSIZE, // output buffer size
BUFSIZE, // input buffer size
0, // client time-out
NULL); // default security attribute
Klockwork flags the variable in line 3 of the code. When the FILE_FLAG_FIRST_PIPE_INSTANCE parameter isn't used with CreateNamedPipe, it's possible for the pipe to be created over an existing file. In such a case, a malicious user could obtain security-sensitive data or possibly execute arbitrary commands.
Fixed code example
hPipe = CreateNamedPipe(
lpszPipename, // pipe name
FILE_FLAG_FIRST_PIPE_INSTANCE |
mode, // read/write access
PIPE_TYPE_MESSAGE | // message type pipe
PIPE_READMODE_MESSAGE | // message-read mode
PIPE_WAIT, // blocking mode
PIPE_UNLIMITED_INSTANCES, // max. instances
BUFSIZE, // output buffer size
BUFSIZE, // input buffer size
0, // client time-out
NULL); // default security attribute
In the fixed code example, the FILE_FLAG_FIRST_PIPE_INSTANCE is used as the second parameter in the CreateNamedPipe function, ensuring that the pipe won't be created over an existing function.
Related checkers
External guidance
- CWE-242: Use of Inherently Dangerous Function
- CWE-421: Race Condition During Access to Alternate Channel
- STIG-ID:APP3450.1 Access Control
- STIG-ID:APP3480.1 Role-Based Access
- STIG-ID:APP3480.2 Role-Based Access
- STIG-ID:APP3500 Excessive Privileges
- STIG-ID:APP3630.4 Application vulnerable to race conditions
Security training
Application security training materials provided by Secure Code Warrior.