Accessing files should not introduce TOCTOU vulnerabilities

"Time Of Check to Time Of Use" (TOCTOU) vulnerabilities occur when an application:

• First, checks permissions or attributes of a file: for instance, is a file a symbolic link?
• Next, performs some operations such as writing data to this file.

The application cannot assume the state of the file is unchanged between these two steps, there is a race condition (ie: two different processes can access and modify the same shared object/file at the same time, which can lead to privilege escalation, denial of service and other unexpected results).

For instance, attackers can benefit from this situation by creating a symbolic link to a sensitive file directly after the first step (eg in Unix: /etc/passwd) and try to elevate their privileges (eg: if the written data has the correct /etc/passwd file format).

To avoid TOCTOU vulnerabilities, one possible solution is to do a single atomic operation for the "check" and "use" actions, therefore removing the race condition window. Another possibility is to use file descriptors. This way the binding of the file descriptor to the file cannot be changed by a concurrent process.

See

• OWASP Top 10 2017 Category A5 - Boken Access Control
• MITRE, CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
• CERT, FIO45-C. - Avoid TOCTOU race conditions while accessing files