Content deleted Content added
CyberSkull (talk | contribs) |
Thumperward (talk | contribs) tidy a bit |
||
Line 1:
A simple example is as follows: Consider a Web application that allows a user to edit pages, and also allows administrators to lock pages to prevent editing. A user requests to edit a page, getting a form by which he can alter its content. Before the user submits the form, an administrator locks the page, which should prevent editing. However, since the user has already begun editing, when he submits the form, his edits are accepted. When the user began editing, his authorization was ''checked'', and he was indeed allowed to edit. However, the authorization was ''used'' later, after he should no longer have been allowed.
TOCTTOU race conditions are most common in
==
In [[Unix]], the following [[C (programming language)|C]] code, when used in a <code>[[setuid]]</code> program, is a TOCTTOU bug:
Line 16:
write(fd, buffer, sizeof(buffer));
</source>
Here, ''access'' is intended to check whether the real user who executed the <code>setuid</code> program would normally be allowed to write the file (i.e., <code>''access''</code> checks the [[real userid]] rather than [[effective userid]]).
Line 55 ⟶ 56:
Exploiting a TOCTTOU race condition requires precise timing to ensure that the attacker's operations interleave properly with the victim's. In the example above, the attacker must execute the <code>symlink</code> system calls precisely between the <code>access</code> and <code>open</code>. For the most general attack, the attacker must be scheduled for execution after each operation by the victim, also known as "single-stepping" the victim.
Techniques for single-stepping a victim program include file system mazes<ref>[http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.117.7757 Borisov, Nikita; Johnson, Rob; Sastry, Naveen; and Wagner, David; 2005;
File system mazes force the victim to read a directory entry that is not in the OS cache, and the OS puts the victim to sleep while it is reading the directory from disk. Algorithmic complexity attacks force the victim to spend its entire scheduling quantum inside a single system call traversing the kernel's hash table of cached file names. The attacker creates a very large number of files with names that hash to the same value as the file the victim will look up.
Line 61 ⟶ 62:
== Preventing TOCTTOU ==
Despite conceptual simplicity, TOCTTOU race conditions are difficult to avoid and eliminate. In the context of file system TOCTTOU race conditions, the fundamental challenge is ensuring that the file system cannot be changed between two system calls. In 2004, an impossibility result was published, showing that there was no portable, deterministic technique for avoiding TOCTTOU race conditions.<ref>
Since this impossibility result, most UNIX systems (including Linux and Solaris) have adopted variants of common file system calls that operate on file handles rather than file names. These calls end in the "at" suffix, such as <code>openat</code>, <code>statat</code>, etc. Because file handles are a private mapping to a file, they cannot be changed by another program and are not subject to race conditions with other applications. The example above can be rewritten using these calls to avoid a TOCTTOU race condition:
Line 75 ⟶ 76:
</source>
This example is safe from race conditions because the file name "file" is only looked up once. More elaborate libraries for tracking file descriptors and ensuring correctness have been proposed by researchers.<ref>[http://domino.watson.ibm.com/library/CyberDig.nsf/1e4115aea78b6e7c85256b360066f0d4/c4028924309762d18525746e004a4feb Tsafrir, Dan; Hertz, Tomer; Wagner, David; and Da Silva, Dilma; 2008;
An alternative solution proposed in the research community is for UNIX systems to adopt transactions in the file system or the OS kernel. Transactions provide a [[concurrency control]] abstraction for the OS, and can be used to prevent TOCTTOU races. While no production UNIX kernel has yet adopted transactions, proof-of-concept research prototypes have been developed for Linux, including the Valor file system<ref>[http://www.fsl.cs.sunysb.edu/docs/valor/valor_fast2009.pdf Spillane, Richard; Gaikwad, Sachin; Chinni, Manjunath; Zadok, Erez; and Wright, Charles P.; 2009;
[[File locking]] is a common technique for preventing race conditions for a single file, but it does not extend to the file system namespace and other metadata, and cannot prevent TOCTTOU race conditions.
== References ==
{{Reflist}}
== Further reading ==
* Bishop, Matt; and Dilger, Michael; 1996; [http://nob.cs.ucdavis.edu/bishop/papers/1996-compsys/racecond.pdf ''Checking for race conditions in file accesses'']; Computing Systems, Vol. 9, No. 2, pp. 131–152
* Tsafrir, Dan; Hertz, Tomer; Wagner, David; and Da Silva, Dilma; 2008; [http://www.cs.berkeley.edu/~daw/papers/tocttou-fast08.pdf ''Portably Solving File TOCTTOU Races with Hardness Amplification''], Proceedings of the 6th USENIX Conference on File and Storage Technologies (FAST '08), San Jose (CA), February 26–29, 2008, pp. 189–206
| |||