CWE-367 (检查时间与使用时间(TOCTOU)的竞争条件) — Vulnerability Class 413

CWE-367 represents a logic flaw where a system verifies a resource’s state before accessing it, allowing the state to change maliciously between the verification and actual usage. Attackers typically exploit this race condition by manipulating the resource, such as swapping a file or altering permissions, during the narrow window between the check and the use. This enables unauthorized access or privilege escalation, as the application proceeds based on outdated, validated assumptions. To mitigate this vulnerability, developers must ensure atomic operations, ensuring that the check and use occur simultaneously without interruption. Implementing robust locking mechanisms, utilizing secure system calls that combine verification and access, or adopting file descriptor-based approaches can effectively prevent state changes, thereby eliminating the race condition and securing the resource against temporal manipulation.