Testing race conditions with memory access tracing and stack-based delay injection
MAccConc is a Linux kernel race condition testing tool using KCOV-based memory access tracing and stack-based delay injection to discover, confirm, and reproduce concurrent thread interleavings. The tool uses ASAN outline-mode instrumentation and KCOV to trace memory accesses across threads, identifying communication points where concurrent accesses could race. Count-augmented stack traces provide stable cross-execution identifiers, and a custom ioctl enables delay injection to force specific execution orderings for bug confirmation and regression testing.
Detection / Hunteropenrouter
Key Takeaways
- Requires LLVM 23.1.0 and a patched Linux kernel branch not yet upstream
- Automatic A-B-A interleaving tester explores all possible two-thread orderings
- GUI supports manual ordering constraint creation between memory access pairs
- ASAN instrumentation misses some on-stack and global memory accesses
- Demonstrated on concurrent dup() and close() file descriptor race condition
Attack Chain
- Instrumentation: Kernel compiled with ASAN outline-mode and KCOV to trace per-access memory reads and writes
- Coverage Collection: Test case executed; KCOV records memory accesses with count-augmented stack traces across threads
- Analysis: Userspace identifies communication points where two threads access overlapping memory with at least one write
- Delay Injection: KCOV_SET_DI ioctl forces specific thread interleavings via spin-wait flags at identified stack traces
- Verification: Test case re-run under forced ordering to confirm or disprove the race condition bug
Affected Systems
- Linux kernel with patched KCOV branch
- LLVM 23.1.0 or later
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | Article describes kernel testing tooling, not adversary behavior detectable by EDR. |
| Network Visibility | None | No network-based attacker activity described; tool operates at kernel memory level. |
| Detection Difficulty | N/A | Article is about testing methodology, not detecting adversary activity. |
False Positive Assessment
Low — Article describes a testing tool, not detection logic that could generate false positives.
Plain-Language Summary
A Google Project Zero researcher built a tool called MAccConc that helps find and reproduce race condition bugs in the Linux kernel. Race conditions happen when multiple threads access shared data at the same time with unpredictable timing. The tool traces memory accesses, identifies points where threads could interfere with each other, and lets the tester force specific execution orderings to prove a bug exists. It requires a patched kernel and recent LLVM compiler.
