Weakness (CWE)
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
How to prevent it (7 mitigations)
-
Implementation
The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
-
Implementation
When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
-
Architecture and Design
Limit the interleaving of operations on files from multiple processes.
-
Implementation, Architecture and Design
If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
-
Implementation
Recheck the resource after the use call to verify that the action was taken appropriately.
-
Architecture and Design
Ensure that some environmental locking mechanism can be used to protect resources effectively.
-
Implementation
Ensure that locking occurs before the check, as opposed to afterwards, such that the resource, as checked, is the same as it is when in use.
Source: MITRE CWE-367
856 results · Feed
-
High 7.8
A Time of Check Time of Use (TOCTOU) vulnerability was reported in IMController, a software component of Lenovo System …
-
High 7.8
A race condition vulnerability was reported in IMController, a software component of Lenovo System Interface Foundation…
-
High 7.8
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in gruntjs/grunt
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to…
-
Medium 6.0
Logitech Sync desktop application prior to 2.4.574 - TOCTOU during installation leads to privelege escalation
There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.
-
Medium 4.4
Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with ac…
-
Low 2.9
Use after free vulnerability in dsp_context_unload_graph function of DSP driver prior to SMR Apr-2022 Release 1 allows …
-
High 7.5
McAfee Total Protection (MTP) - File Deletion vulnerability
A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privilege elevation and perform an arbitrary file delete. This could lead to sensitive files being deleted…
-
Medium 4.7
B2 Command Line Tool TOCTOU application key disclosure
B2 Command Line Tool is the official command line tool for the backblaze cloud storage service. Linux and Mac releases of the B2 command-line tool version 3.2.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by …
-
Medium 4.7
b2-sdk-python TOCTOU application key disclosure
b2-sdk-python is a python library to access cloud storage provided by backblaze. Linux and Mac releases of the SDK version 1.14.0 and below contain a key disclosure vulnerability that, in certain conditions, can be exploited by local attackers through a time-…
-
High 7.1
Insecure temporary file in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses `tempfile.mktemp` to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the fil…
-
Low 2.2
Bypass of Kubernetes API Server proxy TOCTOU
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part…
-
High 7.0
Local privilege escalation with FileStore
The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of …
-
Unscored —
On BIG-IP version 16.x before 16.1.0, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.4, and all versions of 13.1.x, 12.1.…
-
Unscored —
A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a …
-
High 7.3CVE-2022-21658 Public exploit
Race condition in std::fs::remove_dir_all in rustlang
Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG was notified that the `std::fs::remove_dir_all` standard library function is vulnerable a race condi…
-
Critical 9.8
RPC call failure in ckb
An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
-
Unscored —
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to …
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Linux and Mac OS with VPN Posture (HostScan) Module Shared Library Hijacking Vulnerability
A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated, local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture (HostSca…
-
High 7.2
PAN-OS: Unsigned Code Execution During Plugin Installation Race Condition Vulnerability
A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impact…
-
Medium 6.5
Junos OS: User-defined ARP Policer isn't applied on Aggregated Ethernet (AE) interface until firewall process is restarted
When user-defined ARP Policer is configured and applied on one or more Aggregated Ethernet (AE) interface units, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability between the Device Control Daemon (DCD) and firewall process (dfwd) daemons of J…
-
Critical 9.8CVE-2021-32708 Public exploit
Time-of-check Time-of-use (TOCTOU) Race Condition in league/flysystem
Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely. The condition…
-
High 7.0
Cisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability
A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the A…
-
High 7.6CVE-2021-30465 EPSS 10%
mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange a…
-
Unscored —
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a…
-
High 7.3
This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desk…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-…
-
Medium 5.3
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Jenkins 2.275 and LTS 2.263.2 allows reading arbitrary files using the file browser for workspaces and archived artifacts due to a time-of-check to time-of-use (TOCTOU) race condition.
-
High 8.1
Memory safety violation in crayon
An issue was discovered in the crayon crate through 2020-08-31 for Rust. A TOCTOU issue has a resultant memory safety violation via HandleLike.
-
Unscored —CVE-2020-25860 Public exploit
The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnera…
-
High 8.8
Medtronic MyCareLink Smart Time-of-check Time-of-use Race Condition
Medtronic MyCareLink Smart 25000 is vulnerable to a race condition in the MCL Smart Patient Reader software update system, which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited, an attacker could remotely execute code …
-
Unscored —
The Trusted Platform Modules (TPM) reference software may not properly track the number of times a failed shutdown happ…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook mo…
-
High 7.7
Acrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege Escalation
Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability that could result in local privilege escalation.…
-
Medium 6.4
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo a…
-
Unscored —
A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they des…
-
High 7.3
A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalat…
-
High 7.0
TOCTOU in apport
TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process, which…
-
High 7.0CVE-2020-13162 Public exploit
A time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client versions prior to 9.1.6 down…
-
Low 2.5
Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.
-
High 7.0
GlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgrade
A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges. This issue can be exploited only while performing a GlobalProtect app upgrade. This issue affects: G…