Avoiding Serialization Vulnerabilities through the Use of Synchronization Contracts

Synchronization contracts facilitate the development and analysis of multi-threaded programs and can be used to guard against serialization vulnerabilities, which pose serious security risks and which are very difficult to detect. In practice, however, real applications cannot be written entirely with a language that supports synchronization contracts, but must incorporate system libraries and third-party code. This paper describes a technique for removing serialization vulnerabilities from existing code in source or (with linker support) binary form, thereby permitting the code to be safely integrated into an application that is written using synchronization contracts. We have applied the technique in writing a multi-threaded web server using synchronization contracts.