Time-of-check to time-of-use - Wikipedia

Jump to content

Search

Search

Donate

Create account

Log in

Personal tools

Donate

Create account

Log in

Time-of-check to time-of-use

6 languages

العربية<br>Deutsch<br>Ελληνικά<br>فارسی<br>עברית<br>日本語

Edit links

From Wikipedia, the free encyclopedia

Class of software bugs

In software development, time-of-check to time-of-use (TOCTOU , TOCTTOU or TOC/TOU ) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check.

TOCTOU race conditions are common in Unix between operations on the file system,[1] but can occur in other contexts, including local sockets and improper use of database transactions. In the early 1990s, the mail utility of BSD 4.3 UNIX had an exploitable race condition for temporary files because it used the mktemp()[2] function.[3]<br>Early versions of OpenSSH had an exploitable race condition for Unix domain sockets.[4] They remain a problem in modern systems; as of 2019, a TOCTOU race condition in Docker allows root access to the filesystem of the host platform.[5] In the 2023 Pwn2Own competition in Vancouver, a team of hackers were able to compromise the gateway in an updated Tesla Model 3 using this bug.[6]<br>In 2025, a TOCTOU race condition in Amazon Web Services' DNS management system for DynamoDB caused a major outage across the US-EAST-1 region. The incident stemmed from outdated DNS plans being applied after newer ones had already been cleaned up, resulting in the deletion of endpoint IP addresses and widespread service failure.[7]

Description<br>[edit]

A program is vulnerable to a TOCTOU race condition if it:

Checks some property or validates some data, and then

Takes some action based on this information;

and the following are the case:

It is possible for other programs that run concurrently with this program to execute in between steps 1 and 2 (the operation is not atomic), and

Other programs can change the property or data (existence of outside control).

Then, if another process does in fact change the property between step 1 and 2, step 2 is performed based on outdated information, which can have unintended consequences.

If the program running is privileged, and an unprivileged process can affect the property, it can effectively execute certain privileged tasks.

In particular, if the property checks whether some action is allowed, and thereby implements a security boundary, such as a permissions check, this permissions check can then be bypassed completely, and a variety of privileged actions can be executed this way (privilege escalation).

Examples<br>[edit]

This section does not cite any sources . Please help improve this section by adding citations to reliable sources. Unsourced material may be challenged and removed. (July 2022) (Learn how and when to remove this message)

In Unix, the following C code, when used in a setuid program, has a TOCTOU bug:

if (access("file", W_OK) != 0) {<br>exit(1);

fd = open("file", O_WRONLY);<br>write(fd, buffer, sizeof(buffer));

Here, access is intended to check whether the real user who executed the setuid program would normally be allowed to write the file (i.e., access checks the real userid rather than effective userid).

This race condition is vulnerable to an attack:

Victim<br>Attacker

if (access("file", W_OK) != 0) {<br>exit(1);

After the access check, before the open, the attacker replaces file with a symlink to the Unix password file /etc/passwd:symlink("/etc/passwd", "file");

fd = open("file", O_WRONLY);<br>write(fd, buffer, sizeof(buffer));

Actually writing over /etc/passwd

In this example, an attacker can exploit the race condition between the access and open to trick the setuid victim into overwriting an entry in the system password database. TOCTOU races can be used for privilege escalation to get administrative access to a machine.

Although this sequence of events requires precise timing, it is possible for an attacker to arrange such conditions without too much difficulty.

The implication is that applications cannot assume the state managed by the operating system (in this case the file system namespace) will not change between system calls.

Reliably timing TOCTOU<br>[edit]

Exploiting a TOCTOU race condition requires precise timing to ensure that the attacker's operations interleave properly with the victim's. In the example above, the attacker must execute the symlink system call precisely between the access and open. For the most general attack, the attacker must be scheduled for execution after each operation by the victim, also known as "single-stepping" the victim.

In the case of BSD 4.3 mail utility and mktemp(),[2] the attacker can simply keep launching mail utility in one process, and keep guessing the temporary file names and keep making symlinks in another process. The attack can usually succeed in less than one minute.

Techniques for single-stepping a...