Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-367 (检查时间与使用时间(TOCTOU)的竞争条件) — Vulnerability Class 325

325 vulnerabilities classified as CWE-367 (检查时间与使用时间(TOCTOU)的竞争条件). AI Chinese analysis included.

CWE-367 represents a logic flaw where a system verifies a resource’s state before accessing it, allowing the state to change maliciously between the verification and actual usage. Attackers typically exploit this race condition by manipulating the resource, such as swapping a file or altering permissions, during the narrow window between the check and the use. This enables unauthorized access or privilege escalation, as the application proceeds based on outdated, validated assumptions. To mitigate this vulnerability, developers must ensure atomic operations, ensuring that the check and use occur simultaneously without interruption. Implementing robust locking mechanisms, utilizing secure system calls that combine verification and access, or adopting file descriptor-based approaches can effectively prevent state changes, thereby eliminating the race condition and securing the resource against temporal manipulation.

MITRE CWE Description
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Common Consequences (6)
Integrity, OtherAlter Execution Logic, Unexpected State
The attacker can gain access to otherwise unauthorized resources.
Integrity, OtherModify Application Data, Modify Files or Directories, Modify Memory, Other
Race conditions such as this kind may be employed to gain read or write access to resources which are not normally readable or writable by the user in question.
Integrity, OtherOther
The resource in question, or other resources (through the corrupted one), may be changed in undesirable ways by a malicious user.
Non-RepudiationHide Activities
If a file or other resource is written in this method, as opposed to in a valid way, logging of the activity may not occur.
Non-Repudiation, OtherOther
In some cases it may be possible to delete files a malicious user might not otherwise have access to, such as log files.
Mitigations (5)
ImplementationThe most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
ImplementationWhen the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
Architecture and DesignLimit the interleaving of operations on files from multiple processes.
Implementation, Architecture and DesignIf you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
ImplementationRecheck the resource after the use call to verify that the action was taken appropriately.
Examples (2)
The following code checks a file, then updates its contents.
struct stat *sb; ... lstat("...",sb); // it has not been updated since the last time it was read printf("stated file\n"); if (sb->st_mtimespec==...){ print("Now updating things\n"); updateThings(); }
Bad · C
The following code is from a program installed setuid root. The program performs certain file operations on behalf of non-privileged users, and uses access checks to ensure that it does not use its root privileges to perform operations that should otherwise be unavailable the current user. The program uses the access() system call to check if the person running the program has permission to access…
if(!access(file,W_OK)) { f = fopen(file,"w+"); operate(f); ... } else { fprintf(stderr,"Unable to open file %s.\n",file); }
Bad · C
CVE IDTitleCVSSSeverityPublished
CVE-2023-27323 Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability — Desktop 7.0AIHighAI2024-05-03
CVE-2024-23463 Anti-Tampering bypass via Repair App functionality — Client Connector 8.8 High2024-04-30
CVE-2024-2440 Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions — Enterprise Server 5.5 Medium2024-04-19
CVE-2024-29062 Secure Boot Security Feature Bypass Vulnerability — Windows 10 Version 1809 7.1 High2024-04-09
CVE-2024-26218 Windows Kernel Elevation of Privilege Vulnerability — Windows 10 Version 1809 7.8 High2024-04-09
CVE-2024-29066 Windows Distributed File System (DFS) Remote Code Execution Vulnerability — Windows Server 2019 7.2 High2024-04-09
CVE-2024-1729 Timing Attack Vulnerability in gradio-app/gradio — gradio-app/gradio 5.9AIMediumAI2024-03-29
CVE-2024-28183 Anti Rollback bypass with physical access and TOCTOU attack — esp-idf 6.1 Medium2024-03-25
CVE-2021-33632 TOCTOU Race Condition problem in iSulad — iSulad 7.0 High2024-03-25
CVE-2024-24692 Zoom Rooms Client for Windows - Race Condition — Zoom Rooms Client for Windows 5.3 Medium2024-03-13
CVE-2024-0163 Dell PowerEdge Server BIOS 和 Dell Precision Rack BIOS 安全漏洞 — PowerEdge BIOS Intel 16G 5.3 Medium2024-03-13
CVE-2024-21433 Windows Print Spooler Elevation of Privilege Vulnerability — Windows 10 Version 1809 7.0 High2024-03-12
CVE-2024-27297 Nix Corruption of fixed-output derivations — nix 6.3 Medium2024-03-11
CVE-2023-52556 OpenBSD 7.4 pf state race condition kernel crash — OpenBSD 5.3 -2024-03-01
CVE-2023-6917 Pcp: unsafe use of directories allows pcp to root privilege escalation — Red Hat Enterprise Linux 9 6.0 Medium2024-02-28
CVE-2024-21362 Windows Kernel Security Feature Bypass Vulnerability — Windows 10 Version 1809 5.5 Medium2024-02-13
CVE-2024-21371 Windows Kernel Elevation of Privilege Vulnerability — Windows 10 Version 1809 7.0 High2024-02-13
CVE-2023-33046 Time-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution Environment — Snapdragon 7.8 High2024-02-06
CVE-2023-46649 Race Condition allows Administrative Access on Organization Repositories — Enterprise Server 6.3 Medium2023-12-21
CVE-2023-6803 Race Condition allows Unauthorized Outside Collaborator — Enterprise Server 5.8 Medium2023-12-21
CVE-2023-6690 GitHub Enterprise Server 安全漏洞 — Enterprise Server 3.9 Low2023-12-21
CVE-2022-45809 WordPress Thumbs Rating Plugin <= 5.0.0 is vulnerable to Race Condition — Thumbs Rating 5.3 Medium2023-12-18
CVE-2023-37867 WordPress Yet Another Stars Rating Plugin <= 3.3.8 is vulnerable to Race Condition — YASR – Yet Another Star Rating Plugin for WordPress 3.7 Low2023-11-30
CVE-2023-5760 Time-of-check to time-of-use (TOCTOU) bug leads to full local privilege escalation. — Avast/Avg Antivirus 8.2 High2023-11-08
CVE-2022-3702 Lenovo Vantage 安全漏洞 — Vantage HardwareScan Plugin 6.1 Medium2023-10-27
CVE-2022-3701 Lenovo Vantage 安全漏洞 — Vantage SystemUpdate Plugin 7.8 High2023-10-27
CVE-2022-3700 Lenovo Vantage 安全漏洞 — Vantage SystemUpdate Plugin 6.1 Medium2023-10-27
CVE-2023-44188 Junos OS: jkdsd crash due to multiple telemetry requests — Junos OS 5.3 Medium2023-10-11
CVE-2023-44128 LGInstallService - Deletion of arbitrary files with system privilege — LG V60 Thin Q 5G(LMV600VM) 5.0 Medium2023-09-27
CVE-2023-3891 Lapce v0.2.8 - Privilege escalation via Race Condition — Lapce 7.3 High2023-09-15

Vulnerabilities classified as CWE-367 (检查时间与使用时间(TOCTOU)的竞争条件) represent 325 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.