Time-of-check to time-of-use: Difference between revisions

Revision as of 23:38, 25 July 2023

Revision as of 08:22, 13 October 2023

Line 43:

{{Unsourced section|date=July 2022}}

In [[Unix]], the following [[C (programming language)|C]] code, when used in a <code>[[setuid]]</code> program, has a TOCTOU bug:

<syntaxhighlight lang="c" line="1">

if (access("file", W_OK) != 0) {

exit(1);

Line 55:

This race condition is vulnerable to an attack:

{| class="wikitable"

|+
!Victim

|!Attacker

|-

|<syntaxhighlight lang="c" line="1">

if (access("file", W_OK) != 0) {

exit(1);

}

fd = open("file", O_WRONLY);

// Actually writing over /etc/passwd

write(fd, buffer, sizeof(buffer));

</syntaxhighlight>

||

|-

<syntaxhighlight lang="c">

|

//

|After the access check, before the open, the attacker replaces <code>file</code> with a [[symlink]] to the Unix password file <code>[[/etc/passwd]]</code>:<syntaxhighlight lang="c">

//

// After the access check

symlink("/etc/passwd", "file");

// Before the open, "file" points to the password database

//

//

</syntaxhighlight>

|-

|<syntaxhighlight lang="c" line="1" start="5">

fd = open("file", O_WRONLY);

write(fd, buffer, sizeof(buffer));

<// syntaxhighlight>Actually writing over <code>/etc/passwd</code>

|

|}

In this example, an attacker can exploit the race condition between the <code>access</code> and <code>open</code> to trick the <code>setuid</code> victim into overwriting an entry in the system password database. TOCTOU races can be used for [[privilege escalation]] to get administrative access to a machine.