CAPEC-25: Forced Deadlock
Description
The adversary triggers and exploits a deadlock condition in the target software to cause a denial of service. A deadlock can occur when two or more competing actions are waiting for each other to finish, and thus neither ever does. Deadlock conditions can be difficult to detect.
- Likelihood of attack
- Low
- Typical severity
- High
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Manipulate Timing and State
Prerequisites
- The target host has a deadlock condition. There are four conditions for a deadlock to occur, known as the Coffman conditions.
- The target host exposes an API to the user.
Skills required
- MediumThis type of attack may be sophisticated and require knowledge about the system's resources and APIs.
Consequences
- Availability
Resource Consumption
A successful forced deadlock attack compromises the availability of the system by exhausting its available resources.
Mitigations
- Use known algorithm to avoid deadlock condition (for instance non-blocking synchronization algorithms).
- For competing actions, use well-known libraries which implement synchronization.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 1 ATT&CK technique above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ISVAInbound Session Volume Analysis1 shared
- D3-ITFInbound Traffic Filtering1 shared
- D3-APCAApplication Protocol Command Analysis1 shared
- D3-CSPPClient-server Payload Profiling1 shared
- D3-NTCDNetwork Traffic Community Deviation1 shared
- D3-NTFNetwork Traffic Filtering1 shared
- D3-NTSANetwork Traffic Signature Analysis1 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis1 shared
- D3-PMADProtocol Metadata Anomaly Detection1 shared
- D3-RTSDRemote Terminal Session Detection1 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis1 shared