Time-of-check to time-of-use: Difference between revisions

Revision as of 18:09, 25 July 2010

Revision as of 19:40, 30 July 2010

Line 45:

|}

In this example, an attacker can exploit the race condition between the access and open to trick the setuid victim into overwriting an entry in the system password database. TOCTTOU races can be used for [[privilege escalation]], to get administrative access to a machine.

Although this sequence of events requires precise timing, it is possible for an attacker to arrange such conditions without too much difficulty.