Time-of-check to time-of-use: Difference between revisions

Revision as of 17:22, 17 July 2022

Revision as of 04:55, 25 August 2022

Line 80:

|}

In this example, an attacker can exploit the race condition between the <code>access</code> and <code>open</code> to trick the <code>setuid</code> victim into overwriting an entry in the system password database. TOCTOU races can be used for [[privilege escalation]], to get administrative access to a machine.

Although this sequence of events requires precise timing, it is possible for an attacker to arrange such conditions without too much difficulty.