Content deleted Content added
→Preventing TOCTOU: improve clarity. |
CortexFiend (talk | contribs) Link suggestions feature: 3 links added. |
||
| (7 intermediate revisions by 6 users not shown) | |||
Line 38:
| date=28 May 2019
| publisher=Duo Security
| access-date=2019-05-29}}</ref> In the 2023
== Examples ==
Line 86:
== Reliably timing TOCTOU ==
Exploiting a TOCTOU race condition requires precise timing to ensure that the attacker's operations interleave properly with the victim's. In the example above, the attacker must execute the <code>symlink</code> [[system call]] precisely between the <code>access</code> and <code>open</code>. For the most general attack, the attacker must be scheduled for execution after each operation by the victim, also known as "single-stepping" the victim.
In the case of BSD 4.3 mail utility and <code>mktemp()</code>,<ref name="mktemp"/> the attacker can simply keep launching mail utility in one process, and keep guessing the [[temporary file]] names and keep making symlinks in another process. The attack can usually succeed in less than one minute.
Techniques for single-stepping a victim program include file system mazes<ref>{{cite journal
Line 99:
| last4=Wagner
| first4=David
| title=Fixing races for fun and profit: how to abuse atime
| journal=Proceedings of the 14th Conference on USENIX Security Symposium
| publisher=USENIX Association
| ___location=Baltimore, MD
| date=August 2005
Line 114:
| chapter=Exploiting Unix File-System Races via Algorithmic Complexity Attacks
| chapter-url=https://www3.cs.stonybrook.edu/~rob/papers/races2.pdf
| publisher=IEEE Computer Society
| ___location=Berkeley, CA
| date=May 2009
Line 125 ⟶ 126:
}}</ref> In both cases, the attacker manipulates the OS state to control scheduling of the victim.
File system mazes force the victim to read a directory entry that is not in the OS cache, and the OS puts the victim to sleep while it is reading the directory from disk. Algorithmic complexity attacks force the victim to spend its entire scheduling quantum inside a single system call traversing the kernel's [[hash table]] of cached file names. The attacker creates a very large number of files with names that hash to the same value as the file the victim will look up.
== Preventing TOCTOU ==
Despite conceptual simplicity, TOCTOU race conditions are difficult to avoid and eliminate. One general technique is to use error handling instead of pre-checking, under the philosophy of EAFP – "It is easier to ask for forgiveness than permission"
| last=Martelli
| first=Alex
Line 141 ⟶ 142:
| isbn=978-0-596-10046-9}}</ref>
In the context of file system TOCTOU race conditions, the fundamental challenge is ensuring that the file system cannot be changed between two system calls. In 2004, an impossibility result was published, showing that there was no portable, deterministic technique for avoiding TOCTOU race conditions when using the
| last1=Dean
| first1=Drew
| last2=Hu
| first2=Alan J.
| title=Fixing Races for Fun and Profit: How to use access(2)
| journal=Proceedings of the 13th USENIX Security Symposium
Line 170:
| url=https://dominoweb.draco.res.ibm.com/c4028924309762d18525746e004a4feb.html}}</ref>
An alternative solution proposed in the research community is for
| last1=Spillane
| first1=Richard P.
Line 179:
| last4=Zadok
| first4=Erez
| title=Enabling Transactional File Access via Lightweight Kernel Extensions
| work=Seventh USENIX Conference on File and Storage Technologies (FAST 2009)
Line 195 ⟶ 194:
| last5=Witchel
| first5=Emmett
| title=Operating System Transactions
| work=Proceedings of the 22nd [[Association for Computing Machinery|ACM]] Symposium on Operating Systems Principles (SOSP '09)
Line 205 ⟶ 203:
| last2=Solomon
| first2=David A.
| title=Windows Internals
| publisher=[[Microsoft Press]]
| |||