Critical Race Condition in SchedulerWorker Exposes System to Duplicate Process Forking
A critical race condition vulnerability has been identified within the `SchedulerWorker` class, creating a window where multiple identical processes can be forked simultaneously. The flaw is a classic TOCTOU (Time-of-Check-Time-of-Use) issue, where the system checks for an existing process PID but does not lock the resource before acting on that check. This gap allows a second call to pass the same safety check before the first process has secured the PID file, leading to duplicate execution.
The vulnerability is located in `src/Worker/SchedulerWorker.php` between lines 78-82 and 95. The code checks for an existing PID file using `Utils::getPid()`. If no PID is found (returns 0), it proceeds to fork a new child process. Crucially, the PID file is only written *inside* the newly forked child process, not before the `pcntl_fork()` call. This design flaw significantly extends the dangerous time window. In a race scenario, two separate processes (A and B) can both read the PID file as non-existent, both pass the check, and both execute `fork()`, spawning duplicate child processes.
This defect poses a direct risk of resource exhaustion, task collision, and data corruption, as duplicate workers could attempt to execute the same scheduled task concurrently. The issue signals a fundamental flaw in the concurrency control mechanism for a core system scheduler, requiring an immediate review of locking strategies around PID file management and process forking to prevent uncontrolled process duplication.