CWE-572: Call to Thread run() instead of start()

What is Call to Thread run() instead of start()?

• Overview: This vulnerability occurs when a Java developer mistakenly calls a thread's run() method instead of the start() method. This mistake causes the run() method to execute on the calling thread rather than creating a new thread, which can lead to unexpected behavior and performance issues.

• Exploitation Methods:

• Attackers cannot directly exploit this vulnerability to gain unauthorized access or execute malicious code, but it can lead to performance bottlenecks or logical errors that may be indirectly exploitable in some contexts.
• Common attack patterns and techniques do not typically apply to this vulnerability because it is more of a coding error affecting application logic rather than security boundaries.

• Security Impact:

• Direct consequences include unintended execution flow and performance degradation, as tasks intended to be run concurrently are instead executed sequentially.
• Potential cascading effects could involve application slowdown or resource exhaustion if the intended parallelism is critical for performance.
• Business impact might include reduced application responsiveness, increased latency, and a poor user experience, which could affect business operations and customer satisfaction.

• Prevention Guidelines:

• Specific code-level fixes involve ensuring that the start() method is called on Thread objects to initiate new threads.
• Security best practices include thorough code reviews, using static analysis tools to detect this pattern, and educating developers about proper thread handling.
• Recommended tools and frameworks include IDEs with built-in error detection, static analysis tools like FindBugs or SonarQube, and concurrency frameworks like Java's ExecutorService to manage thread execution more safely.

Corgea can automatically detect and fix Call to Thread run() instead of start() in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Java

Affected Technologies: Not specified

Vulnerable Code Example

Java Example

// ThreadExample.java {8-10}
public class ThreadExample {
    public static void main(String[] args) {
        MyRunnable myRunnable = new MyRunnable();
        Thread thread = new Thread(myRunnable);
        
        // Vulnerable: Calling run() method directly
        // This will execute the run method in the main thread, not in a new thread
        thread.run(); 
    }
}

class MyRunnable implements Runnable {
    public void run() {
        System.out.println("Running in a separate thread");
    }
}

Explanation

In the vulnerable code example, the run() method of the Thread object is called directly. This causes the run() method to be executed in the main thread, rather than creating a new thread. This negates the benefits of multi-threading, such as concurrent execution and improved performance in multi-core systems.

How to fix Call to Thread run() instead of start()?

To address this issue, use the start() method of the Thread class. The start() method initiates a new thread and then calls the run() method within that new thread, allowing for concurrent execution.

Key Fix:

• Replace thread.run() with thread.start() to ensure that execution occurs in a new thread.

Fixed Code Example

// ThreadExample.java {8-10}
public class ThreadExample {
    public static void main(String[] args) {
        MyRunnable myRunnable = new MyRunnable();
        Thread thread = new Thread(myRunnable);
        
        // Fixed: Calling start() method to execute run() in a new thread
        thread.start(); 
    }
}

class MyRunnable implements Runnable {
    public void run() {
        System.out.println("Running in a separate thread");
    }
}

Explanation

In the fixed code example, the thread.start() method is used. This correctly initiates a new thread and allows the run() method of MyRunnable to execute concurrently in a separate thread from the main thread. This is the appropriate approach for leveraging Java's threading capabilities, ensuring that tasks can run simultaneously, which is essential for applications requiring concurrent processing.