Weakness (CWE)
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
How to prevent it (7 mitigations)
-
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
-
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
-
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
-
Implementation, Architecture and Design
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
-
Implementation
Recheck the resource after the use call to verify that the action was taken appropriately.
-
Architecture and Design
Ensure that some environmental locking mechanism can be used to protect resources effectively.
-
Implementation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
Source: MITRE CWE-367
317 results · Clear filters · Feed
-
Medium 6.4
DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. …
-
Medium 6.4
DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver cou…
-
Medium 6.4
DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on t…
-
Medium 6.4
DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SM…
-
Medium 6.4
DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM …
-
Medium 6.4
Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler use…
-
Medium 6.4
DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have bee…
-
Medium 6.4
DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have b…
-
Medium 6.4
In jpeg, there is a possible use after free due to a race condition. This could lead to local escalation of privilege w…
-
Medium 5.9
Alpine before 2.25 allows remote attackers to cause a denial of service (application crash) when LIST or LSUB is sent b…
-
Medium 5.9
Junos OS and Junos OS Evolved: In a BGP multipath scenario, when one of the contributing routes is flapping often and rapidly, rpd may crash
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated attacker with an established BGP session to cause a Denial of Service (DoS). In …
-
Medium 5.9
Junos OS and Junos OS Evolved: Due to a race condition the rpd process can crash upon receipt of a BGP update message containing flow spec route
A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS, Junos OS Evolved allows a network-based unauthenticated attacker to cause a Denial of Service (DoS). When a BGP flow route with re…
-
Medium 4.7CVE-2022-29800 Public exploit
A time-of-check-time-of-use (TOCTOU) race condition vulnerability was found in networkd-dispatcher. This flaw exists be…
-
Medium 6.1
Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicio…
-
Medium 6.0
Cisco Nexus Dashboard Privilege Escalation Vulnerabilities
Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An a…
-
Medium 6.0
Cisco Nexus Dashboard Privilege Escalation Vulnerabilities
Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An a…
-
Medium 6.0
Cisco Nexus Dashboard Privilege Escalation Vulnerabilities
Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An a…
-
Medium 6.0
Cisco Nexus Dashboard Privilege Escalation Vulnerabilities
Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabilities are due to insufficient input validation during CLI command execution on an affected device. An a…
-
Medium 6.2
A possible race condition vulnerability in score driver prior to SMR Jul-2022 Release 1 can allow local attackers to in…
-
Medium 6.0
Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation
There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.
-
Medium 4.4
Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with ac…
-
Medium 4.7
B2 Command Line Tool TOCTOU application key disclosure
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by …
-
Medium 4.7
b2-sdk-python TOCTOU application key disclosure
b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-…
-
Medium 6.5
Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted
When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of J…
-
Medium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook mo…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo a…
-
Medium 5.6
Apport race condition in crash report permissions
Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled, this can be exploited between the os.open and os.chown calls when t…
-
Medium 5.3
Insufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of OPC Foundation UA .NET Standard 1.04.358.30. Authentication is not required to exploit this vulnerability. The specific flaw exists within the hand…
-
Medium 5.0
Junos OS: Privilege escalation vulnerability in dual REs, VC or HA cluster may allow unauthorized configuration change.
A privilege escalation vulnerability in Juniper Networks Junos OS devices configured with dual Routing Engines (RE), Virtual Chassis (VC) or high-availability cluster may allow a local authenticated low-privileged user with access to the shell to perform unau…
-
Medium 6.2
race condition on texlive-filesystem cron job allows for the deletion of unintended files
A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Devel…
-
Medium 4.9
race condition in the packaging of texlive-filesysten
A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Ki…
-
Medium 5.9
TOCTOU Race Condition in Yarn
The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
-
Medium 6.5
Apport contains a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml
Apport before versions 2.14.1-0ubuntu3.29+esm1, 2.20.1-0ubuntu2.19, 2.20.9-0ubuntu7.7, 2.20.10-0ubuntu27.1, 2.20.11-0ubuntu5 contained a TOCTTOU vulnerability when reading the users ~/.apport-ignore.xml file, which allows a local attacker to replace this file…
-
Medium —
devise Time-of-check Time-of-use Race Condition vulnerability
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that…
-
Medium 5.0
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_pa…
-
Medium 5.1