Security Vulnerability in pthread_cond_wait (GLIBC): Thread can release another thread's mutex lock

[Florian Weimer]

> Function: pthread_cond_wait(pthread_cond_t *restrict cond, pthread_mutex_t *restrict mutex)
>
> Problem: When using a mutex initialized with PTHREAD_MUTEX_NORMAL type
> (the default behavior), calling pthread_cond_wait() from a thread that
> does NOT hold the mutex can still release the mutex if it is held by
> another thread.

POSIX and others document that pthread_cond_wait unlocks the mutex, and
that unlocking a PTHREAD_MUTEX_NORMAL mutex while not the owner is
undefined.  This is an application bug because the application is not
using the pthread_cond_wait function correctly, violating its
preconditions.

Thanks,
Florian