What is Call to Thread run() instead of start() (CWE-572)?

TL;DR: Call to Thread run() instead of start() (CWE-572) is a vulnerability where the run() method on a thread object is called directly, leading to incorrect execution flow and potential deadlocks. Fix it by replacing direct calls to run() with start().

What is Call to Thread run() instead of start()?

Call to Thread run() instead of start() (CWE-572) is a type of concurrency control vulnerability that occurs when the run() method on a thread object is called directly, rather than using the start() method. As defined by the MITRE Corporation under CWE-572, and classified by the OWASP Foundation as not directly mapped to an official category.

Quick Summary

This mistake can cause incorrect execution flow in multithreaded applications, leading to potential deadlocks or race conditions where threads wait indefinitely for each other to release resources. Jump to: What is Call to Thread run() instead of start()? · Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes · Ask AI · Best Practices · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Call to Thread run() instead of start() Overview · How Call to Thread run() instead of start() Works · Business Impact of Call to Thread run() instead of start() · Call to Thread run() instead of start() Attack Scenario · How to Detect Call to Thread run() instead of start() · How to Fix Call to Thread run() instead of start() · Framework-Specific Fixes for Call to Thread run() instead of start() · How to Ask AI to Check Your Code for Call to Thread run() instead of start() · Call to Thread run() instead of start() Best Practices Checklist · Call to Thread run() instead of start() FAQ · Vulnerabilities Related to Call to Thread run() instead of start() · References · Scan Your Own Site

Call to Thread run() instead of start() Overview

What: A mistake in multithreading where run() is called directly on a thread object. Why it matters: Incorrect execution flow, potential deadlocks. Where it occurs: Multithreaded applications using Java, Python, or .NET. Who is affected: Developers and maintainers of such applications. Who is NOT affected: Applications that do not use threads or have correctly implemented threading logic.

How Call to Thread run() instead of start() Works

Root Cause

The root cause lies in the incorrect invocation of a thread’s run() method instead of its start() method, leading to improper execution context and potential synchronization issues.

Attack Flow

1. Developer calls thread.run() directly.
2. The code inside run() executes within the current thread’s context rather than creating a new thread.
3. This can lead to unexpected behavior such as deadlocks or race conditions.

   Prerequisites to Exploit

   • Thread object must be instantiated and accessible.
   • Direct call to run() method instead of start().

     Vulnerable Code

     Thread myThread = new Thread(new Runnable() {
     public void run() { System.out.println("Running"); }
     });
     myThread.run();
     

     This code directly calls the run() method, causing incorrect execution context.

     Secure Code

     Thread myThread = new Thread(new Runnable() {
     public void run() { System.out.println("Running"); }
     });
     myThread.start();
     

     Using start() ensures proper thread creation and execution in its own context.

Business Impact of Call to Thread run() instead of start()

Confidentiality: No direct impact. Integrity: Potential data corruption due to race conditions. Availability: Deadlocks leading to unresponsive applications.

• Financial loss from downtime.
• Compliance penalties for system failures.
• Reputation damage from service interruptions.

Call to Thread run() instead of start() Attack Scenario

1. Developer writes multithreaded code using Java or Python.
2. Mistakenly calls run() directly on a thread object.
3. Application exhibits unexpected behavior such as deadlocks or race conditions.
4. System becomes unresponsive, leading to service disruptions.

How to Detect Call to Thread run() instead of start()

Manual Testing

• Review code for direct calls to thread.run().
• Ensure threads are started with start() method.

  Automated Scanners (SAST/DAST)

  Static analysis tools can detect direct calls to run(), while dynamic testing may be needed to confirm actual behavior in runtime context.

  PenScan Detection

  PenScan’s ZAP and Nuclei scanners actively identify incorrect thread invocation patterns.

  False Positive Guidance

  False positives occur when the code is correctly using start() but appears similar to a direct call.

How to Fix Call to Thread run() instead of start()

• Use thread.start() instead of thread.run().

Framework-Specific Fixes for Call to Thread run() instead of start()

Java

Thread myThread = new Thread(new Runnable() {
  public void run() { System.out.println("Running"); }
});
myThread.start();

Ensure threads are started with the start() method.

Python/Django

import threading

def thread_function():
    print('Running')

thread = threading.Thread(target=thread_function)
thread.start()

Use threading.Thread and call start().

Node.js/PHP (Not applicable, use Java or Python examples)

How to Ask AI to Check Your Code for Call to Thread run() instead of start()

Call to Thread run() instead of start() Best Practices Checklist

✅ Always use thread.start() to initiate thread execution. ✅ Review existing multithreaded applications for direct run() calls. ✅ Educate developers on proper threading practices.

Call to Thread run() instead of start() FAQ

How does Call to Thread run() instead of start() occur?

It occurs when a developer mistakenly calls the run() method directly on a thread object, rather than using the start() method which properly initiates the thread’s execution in its own context.

Why is it important to use start() over run()?

Using start() ensures that the thread runs independently and does not execute within the calling thread’s context, preventing unexpected behavior such as deadlocks or race conditions.

What are the consequences of this mistake?

The main consequence is incorrect execution flow leading to potential deadlock situations where threads wait indefinitely for each other to release resources.

Can static analysis tools find this issue?

Yes, SAST tools can identify direct calls to the run() method and flag them as potential issues.

What is a real-world example of this vulnerability?

A common scenario involves legacy Java applications where developers might have used run() instead of start(), leading to incorrect thread behavior.

How do I fix Call to Thread run() instead of start() in my code?

Replace direct calls to the run() method with start(). For example, change thread.run() to thread.start().

What should developers know about this vulnerability?

Developers must understand that calling run() directly executes the thread’s logic within the current thread context, which can lead to synchronization issues and other concurrency problems.

Vulnerabilities Related to Call to Thread run() instead of start()

| CWE | Name | Relationship | |—|—|—| | CWE-821 | Incorrect Synchronization (ChildOf) |

References

• MITRE
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Call to Thread run() instead of start() and other risks before an attacker does.