If the FILE_FLAG_FIRST_PIPE_INSTANCE parameter isn't used in the CreateNamedPipe function, the pipe can be created over an existing file, allowing a malicious user to obtain security-sensitive data or possibly execute arbitrary commands.

The SV.PIPE.CONST checker finds instances in which the CreateNamedPipe function is used without FILE_FLAG_FIRST_PIPE_INSTANCE.

Vulnerability and risk

Named pipes and shared files can compromise the system and allow unauthorized users to obtain user names of legitimate users or other sensitive information. The primary risk from this vulnerability is that a malicious user could gain additional privileges and hijack the pipe to run arbitrary programs.

Mitigation and prevention

Using the FILE_FLAG_FIRST_PIPE_INSTANCE flag as the second argument in CreateNamedPipe protects against pipe highjacking attacks by ensuring that the pipe you're creating hasn't already been created.

Vulnerable code example

hPipe = CreateNamedPipe( 
       lpszPipename,         // pipe name 
       PIPE_ACCESS_DUPLEX,     // read/write access 
       PIPE_TYPE_MESSAGE |     // message type pipe 
       PIPE_READMODE_MESSAGE |  // message-read mode 
       PIPE_WAIT,           // blocking mode 
       PIPE_UNLIMITED_INSTANCES, // max. instances  
       BUFSIZE,            // output buffer size 
       BUFSIZE,            // input buffer size 
       0,                // client time-out 
       NULL);              // default security attribute

Klockwork flags this code, since the FILE_FLAG_FIRST_PIPE_INSTANCE parameter isn't used in the CreateNamedPipe function. This code allows the pipe to be created over an existing file, which could enable a malicious user to obtain security-sensitive data or possibly execute arbitrary commands.

Fixed code example

1    hPipe = CreateNamedPipe( 
2          lpszPipename,         // pipe name 
3          FILE_FLAG_FIRST_PIPE_INSTANCE |
4          PIPE_ACCESS_DUPLEX,     // read/write access 
5          PIPE_TYPE_MESSAGE |     // message type pipe 
6          PIPE_READMODE_MESSAGE |  // message-read mode 
7          PIPE_WAIT,           // blocking mode 
8          PIPE_UNLIMITED_INSTANCES, // max. instances  
9          BUFSIZE,            // output buffer size 
10          BUFSIZE,            // input buffer size 
11         0,                // client time-out 
12         NULL);              // default security attribute

In the fixed code example, the FILE_FLAG_FIRST_PIPE_INSTANCE parameter has been used, ensuring that the pipe won't be created over an existing file.

SV.PIPE.CONST

Potential pipe hijacking

Vulnerability and risk

Mitigation and prevention

Vulnerable code example

Fixed code example

Related checkers

External guidance