Time of Check to Time of Use
Time of check to time of use (TOCTTOU) is a race condition that affects software. While you read, pay attention to the mechanics of a TOCTTOU attack as provided in the attack examples. Remember the most common platform where you might find a TOCTTOU bug. What methods can be used to prevent TOCTTOU from occurring in UNIX and in Microsoft Windows?
3. Reliably timing TOCTTOU
Exploiting a TOCTTOU race condition requires precise timing to ensure that the attacker’s operations interleave properly with the victim’s. In the example above, the attacker must execute the symlink system call precisely between the access and open. For the most general attack,the attacker must be scheduled for execution after each operation by the victim, also known as "single-stepping" the victim.
In the case of BSD 4.3 mail utility and mktemp(), the attacker can simply keep launching mail utility in one process, and keep guessing the temporary file names and keep making symlinks in another process. The attack can usually succeed in less than one minute.
Techniques for single-stepping a victim program include file system mazes and algorithmic complexity attacks. In both cases, the attacker manipulates the OS state to control scheduling of the victim.
File system mazes force the victim to read a directory entry that is not in the OS cache, and the OS puts the victim to sleep while it is reading the directory from disk. Algorithmic complexity attacks force the victim to spend its entire scheduling quantum inside a single system call traversing the kernel’s hash table of cached file names.The attacker creates a very large number of files with names that hash to the same value as the file the victim will look up.