ISO/IEC TR 24772-1:2019 プログラミング言語—プログラミング言語の脆弱性を回避するためのガイダンス—パート1：言語に依存しないガイダンス | ページ 6

3.1.1

プロトコル

スレッドの相互作用のためのルールとサポート構造のセット

注記 1:プロトコルは密に埋め込まれ、メモリとハードウェア内のデータに依存してスレッドの相互作用を制御することも、ネットワークとコンピュータ システムにまたがるメッセージ通信など、より疎結合の構成に適用することもできます。

3.1.2

ステートレス プロトコル

プロトコル自体に状態が保持されないスレッド間の通信または協調 (例: HTTP または共有リソースへの直接アクセス)

注記 1:スレッド間のほとんどの対話では状態を保持する必要があるため、協調するスレッドはリソース自体の値を使用するか、状態を維持するために追加の通信交換を追加する必要があります。ステートレス プロトコルでは、アプリケーションが明示的なリソース保護とロック メカニズムを提供して、リソースの正しい作成、表示、アクセス、変更、および破棄を保証する必要があります。たとえば、リソースの正しい処理に必要な状態です。

3.2.1

thread

sequential stream of execution

Note 1 to entry: Although the term thread is used here and the context portrayed is that of shared-memory threads executing as part of a process, everything documented applies equally to other variants of concurrency such as interrupt handlers being enabled by a process, processes being created on the same system using operating system routines, or processes created as a result of distributed messages sent over a network. The mitigation approaches will be similar to those listed in the relevant vulnerability descriptions, but the implications for standardization would be dependent on how much language support is provided for the programming of the concurrent system.

3.2.2

thread activation

creation and setup of a thread up to the point where the thread begins execution

Note 1 to entry: A thread can depend on one or more other threads to define its access to other objects to be accessed and to determine its duration.

3.2.3

activated thread

thread that is created and then begins execution as a result of thread activation

3.2.4

activating thread

thread that exists first and makes the library calls or contains the language syntax that causes the activated thread to be activated

Note 1 to entry: The activating thread may wait, or not, for the activated thread to finish activation and may or may not check for errors if the activation fails. The activating thread can be permitted, or not, to terminate until after the activated thread terminates.

3.2.5

static thread activation

creation and initiation of a thread by program initiation, an operating system or runtime kernel, or by another thread as part of a declarative part of the thread before it begins execution

Note 1 to entry: In static activation, a static analysis can determine exactly how many threads will be created and how much resource, in terms of memory, processors, CPU cycles, priority ranges and inter-thread communication structures, will be needed by the executing program before the program begins.

3.2.6

dynamic thread activation

creation and initiation of a thread by another thread (including the main program) as an executable, repeatable command, statement or subprogram call

3.2.7

thread abort

request to stop and shut down a thread immediately

Note 1 to entry: The request is asynchronous if from another thread, or synchronous if from the thread itself. The effect of the abort request (such as whether it is treated as an exception) and its immediacy (that is, how long the thread can continue to execute before it is shut down) depend on language-specific rules. Immediate shutdown minimizes latency but can leave shared data structures in a corrupted state.

3.2.8

termination-directing thread

thread (including the OS) that requests the abortion of one or more threads

3.2.9

thread termination

completion and orderly shutdown of a thread, where the thread is permitted to make data objects consistent, release any acquired resources, and notify any dependent threads that it is terminating

3.2.10

terminated thread

thread that has been halted from any further execution

3.2.11

master thread

thread which needs to wait for a terminated thread before it can take further execution steps (including termination of itself)

3.2.12

process

single execution of a program, or portion of an application

3.3.1

software quality

degree to which software implements the requirements described by its specification and the degree to which the characteristics of a software product fulfil its requirements

3.3.2

predictable execution

property of the program such that all possible executions have results that can be predicted from the source code

3.4.1

safety hazard

potential source of harm

Note 1 to entry: IEC 61508–4^[20] defines a Hazard as a potential source of harm, where harmisphysical injury or damage to the health of people either directly or indirectly as a result of damage to property or to the environment. Some derived standards, such as UK Defence Standard 00-56, broaden the definition of harm to include material and environmental damage (not just harm to people caused by property and environmental damage).

3.4.2

safety-critical software

software for applications where failure can cause very serious consequences such as human injury or death

Note 1 to entry: IEC 61508–3^[20] defines Safety-related softwareassoftware that is used to implement safety functions in a safety-related system. Although, in some domains a distinction is made between safety-related (can lead to any harm) and safety-critical (life threatening), this document uses the term safety-critical for all vulnerabilities that can result in safety hazards.

3.5.1

application vulnerability

security vulnerability or safety hazard, or defect

3.5.2

language vulnerability

property (of a programming language) that can contribute to, or that is strongly correlated with, application vulnerabilities in programs written in that language.

Note 1 to entry: The term property can mean the presence or the absence of a specific feature, used singly or in combination. As an example of the absence of a feature, encapsulation (control of where names can be referenced from) is generally considered beneficial since it narrows the interface between modules and can help prevent data corruption. The absence of encapsulation from a programming language can thus be regarded as a vulnerability. Note that a property together with its complement can both be considered language vulnerabilities. For example, automatic storage reclamation (garbage collection) can be a vulnerability since it can interfere with time predictability and result in a safety hazard. On the other hand, the absence of automatic storage reclamation can also be a vulnerability since programmers can mistakenly free storage prematurely, resulting in dangling references.

3.5.3

security vulnerability

weakness in an information system, system security procedures, internal controls, or implementation that can be exploited or triggered by a threat

3.5.4

failure

malfunction of the system or component which has as subcategories omission failure, commission failure, timing failure and value failure

3.5.5

omission failure

service that is requested but never rendered

Note 1 to entry: The client can wait forever or can be notified about the failure (termination) of the service.

3.5.6

commission failure

service that initiates unexpected actions, e. g., communication that is unexpected by the receiver

Note 1 to entry: The service can wait forever, causing omission failures for subsequent calls by clients. The receiver can be hindered to do its legitimate actions in time. At a minimum, resources are consumed that are possibly needed by others.

3.5.7

timing failure

service that is not rendered before an imposed deadline

Note 1 to entry: This results in a system response that is (too) late, causing corresponding damages to the real world affected by the system.

3.1.5.8

value failure

service delivers incorrect or tainted results

Note 1 to entry: The client continues computations with these corrupted values, causing a spread of consequential application errors.