Content deleted Content added
There was a Script warning on the page from cite book templates, ___location= was used without the prerequisite publisher=, so added publishers |
CortexFiend (talk | contribs) Link suggestions feature: 3 links added. |
||
Line 86:
== Reliably timing TOCTOU ==
Exploiting a TOCTOU race condition requires precise timing to ensure that the attacker's operations interleave properly with the victim's. In the example above, the attacker must execute the <code>symlink</code> [[system call]] precisely between the <code>access</code> and <code>open</code>. For the most general attack, the attacker must be scheduled for execution after each operation by the victim, also known as "single-stepping" the victim.
In the case of BSD 4.3 mail utility and <code>mktemp()</code>,<ref name="mktemp"/> the attacker can simply keep launching mail utility in one process, and keep guessing the [[temporary file]] names and keep making symlinks in another process. The attack can usually succeed in less than one minute.
Techniques for single-stepping a victim program include file system mazes<ref>{{cite journal
Line 126:
}}</ref> In both cases, the attacker manipulates the OS state to control scheduling of the victim.
File system mazes force the victim to read a directory entry that is not in the OS cache, and the OS puts the victim to sleep while it is reading the directory from disk. Algorithmic complexity attacks force the victim to spend its entire scheduling quantum inside a single system call traversing the kernel's [[hash table]] of cached file names. The attacker creates a very large number of files with names that hash to the same value as the file the victim will look up.
== Preventing TOCTOU ==
| |||