Time-of-Check to Time-of-Use Errors

A time-of-check to time-of-use (TOCTTOU) error is a concurrency issue where control is given to another process between an access control check and the access operation it guards, letting the checked condition change before it is used.

int openfile(char *path) {
    struct stat s;
    if (stat(path, &s) < 0)
        return -1;
    if (!S_ISREG(s.st_mode)) {
        error("only allowed to regular files");
        return -1;
    }
    return open(path, O_RDONLY);
}

stat checks that path is a regular file. Between that check and open, an attacker can change what path refers to, so the file actually opened is not the one checked.

Attack Mechanism

openfile runs in the kernel. At user level, an adversary-controlled program P defines a shared path variable and launches 2 threads T1 and T2 that both see updates to it.

• T1 calls openfile with path set to a regular file.
• T2 concurrently sets path to point to a directory.
• If T2’s write lands between T1’s stat and open, openfile opens the directory despite having checked a regular file.

Prevention

• Ensure critical parameters are not exposed during pre-emption
  openfile owns path exclusively for the duration of the call.
• Ensure serial integrity
  Make openfile atomic, so no pre-emption occurs during its execution.
• Validate critical parameters
  Compute a checksum of path before pre-emption and compare it to a checksum taken after.