CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.¶
MITRE. CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. Common Weakness Enumeration.
Cited by¶
1 citation across 1 artifact.
Each citation links to the sentence it supports in the citing article.
Primes¶
- Time-Of-Check To Time-Of-Use Flaw
- In computer security and concurrency — its original setting — a process checks that a file is owned by the user and then opens it, and an attacker swaps the file for a symlink in between; a web app confirms an account is unblocked and then issues a refund the account was frozen against a millisecond earlier.
This sourceCanonical definition of the TOCTOU race-condition weakness in software security, including the symlink file-access example and the atomic check-and-use remedy.
Supported in partVerified against the work's full text
CWE-367 gives the symlink-swap between a file check and its use as a worked example, but contains no web-app account-refund example and does not say file races were the original setting.
“If an attacker replaces file after the call to access() with a symbolic link to a different file, the program will use its root privileges to operate on the file”
- In computer security and concurrency — its original setting — a process checks that a file is owned by the user and then opens it, and an attacker swaps the file for a symlink in between; a web app confirms an account is unblocked and then issues a refund the account was frozen against a millisecond earlier.
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Read against the text for 1 of 1 citation: 1 supported in part. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:cec76a5db460 · see in the full table