id	summary	reporter	owner	description	type	status	milestone	component	version	severity	resolution	keywords	cc
5834	once.cpp: call_once: suffers from lack of uniqueness and synchronization handle manipulations	noloader@…	viboes	"call_once attempts to form a unique mutex name by concatenating 2AC1A572DB6944B0A65C38C4140AF2F4 with the PID.

As Wagner and Goldberg taught us, PIDs are a useless source of entropy (or part thereof). See http://www.cs.berkeley.edu/~daw/papers/ddj-netscape.html.

An attacker using Win32 can manipulate synchronization objects by (1) squatting the name 'a priori', (2) creating a different type of object using the same name, and (3) creating the expected object but with lesser permissions than the program expects (ie, remove the ability to 'wait' on the mutex). See http://www.softwareintegrity.com/Documents/Old-Dogs-and-New-Tricks.pdf.

In addition, two different routines within the same program, each expecting to be 'run once', will suffer contention.
"	Support Requests	closed	To Be Determined	thread	Boost 1.47.0	Problem	invalid		viboes