text:
Time of check to time of use
From Wikipedia, the free encyclopedia
Jump to: navigation, search
In software development, time of check to time of use (TOCTTOU or TOCTOU, pronounced "TOCK too") is a class of software bugs caused by changes in a system between the checking of a condition (such as a security credential) and the use of the results of that check. This is one example of a race condition.
A simple example is as follows: Consider a Web application that allows a user to edit pages, and also allows administrators to lock pages to prevent editing. A user requests to edit a page, getting a form which can be used to alter its content. Before the user submits the form, an administrator locks the page, which should prevent editing. However, since editing has already begun, when the user submits the form, those edits (which have already been made) are accepted. When the user began editing, the appropriate authorization was checked, and the user was indeed allowed to edit. However, the authorization was used later, at a time when edits should no longer have been allowed.
TOCTTOU race conditions are most common in Unix between operations on the file system, but can occur in other contexts, including local sockets and improper use of database transactions. In the early 1990s, the mail utility of BSD 4.3 UNIX had an exploitable race condition for temporary files because it used the mktemp() C library function.[1] Early versions of OpenSSH had an exploitable race condition for Unix domain sockets.[2]
Contents
[hide]
1 Examples
2 Reliably timing TOCTTOU
3 Preventing TOCTTOU
4 See also
5 References
6 Further reading
Examples[edit]
In Unix, the following C code, when used in a setuid program, has a TOCTTOU bug:
if (access("file", W_OK) != 0) { exit(1); } fd = open("file", O_WRONLY); write(fd, buffer, sizeof(buffer));
Here, access is intended to check whether the real user who executed the setuid program would normally be allowed to write the file (i.e., access checks the real userid rather than effective userid).
This race condition is vulnerable to an attack:
Victim Attacker
if (access("file", W_OK) != 0) { exit(1); } fd = open("file", O_WRONLY); // Actually writing over /etc/passwd write(fd, buffer, sizeof(buffer));
// // // After the access check symlink("/etc/passwd", "file"); // Before the open, "file" points to the password database // //
In this example, an attacker can exploit the race condition between the access and open to trick the setuid victim into overwriting an entry in the system password database. TOCTTOU races can be used for privilege escalation, to get administrative access to a machine.
Although this sequence of events requires precise timing, it is possible for an attacker to arrange such conditions without too much difficulty.
The implication is that applications cannot assume the state managed by the operating system (in this case the file system namespace) will not change between system calls.
Reliably timing TOCTTOU[edit]
Exploiting a TOCTTOU race condition requires precise timing to ensure that the attacker's operations interleave properly with the victim's. In the example above, the attacker must execute the symlink system call precisely between the access and open. For the most general attack, the attacker must be scheduled for execution after each operation by the victim, also known as "single-stepping" the victim.
In the case of BSD 4.3 mail utility and mktemp(),[3] the attacker can simply keep launching mail utility in one process, and keep guessing the temporary file names and keep making symlinks in another process. The attack can usually succeed in less than one minute.
Techniques for single-stepping a victim program include file system mazes[4] and algorithmic complexity attacks.[5] In both cases, the attacker manipulates the OS state to control scheduling of the victim.
File system mazes force the victim to read a directory entry that is not in the OS cache, and the OS puts the victim to sleep while it is reading the directory from disk. Algorithmic complexity attacks force the victim to spend its entire scheduling quantum inside a single system call traversing the kernel's hash table of cached file names. The attacker creates a very large number of files with names that hash to the same value as the file the victim will look up.
Preventing TOCTTOU[edit]
Despite conceptual simplicity, TOCTTOU race conditions are difficult to avoid and eliminate. One general technique is to use exception handling instead of checking, under the philosophy of EAFP "It is easier to ask for forgiveness than permission" rather than LBYL "look before you leap" – in this case there is no check, and failure of assumptions to hold are detected at use time, by an exception.[6]
In the context of file system TOCTTOU race conditions, the fundamental challenge is ensuring that the file system cannot be changed between two system calls. In 2004, an impossibility result was published, showing that there was no portable, deterministic technique for avoiding TOCTTOU race conditions.[7]
Since this impossibility result, libraries for tracking file descriptors and ensuring correctness have been proposed by researchers.[8]
An alternative solution proposed in the research community is for UNIX systems to adopt transactions in the file system or the OS kernel. Transactions provide a concurrency control abstraction for the OS, and can be used to prevent TOCTTOU races. While no production UNIX kernel has yet adopted transactions, proof-of-concept research prototypes have been developed for Linux, including the Valor file system[9] and the TxOS kernel.[10] Microsoft Windows has added transactions to its NTFS file system,[11] but Microsoft discourages their use, and has indicated that they may be removed in a future version of Windows.[12]
File locking is a common technique for preventing race conditions for a single file, but it does not extend to the file system namespace and other metadata, nor does locking work well with networked filesystems, and cannot prevent TOCTTOU race conditions.
For setuid binaries a possible solution is to use the seteuid() system call to change the effective user and then perform the open(). Differences in setuid() between operating systems can be problematic.[13]
See also[edit]
Linearizability
Python syntax and semantics
References[edit]
Jump up ^ Shangde Zhou(周尚德) (1991-10-01). "A Security Loophole in Unix".
Jump up ^ Acheson, Steve (1999-11-04). "The Secure Shell (SSH) Frequently Asked Questions".
Jump up ^ "mktemp(3) - Linux man page".
Jump up ^ Borisov, Nikita; Johnson, Rob; Sastry, Naveen; Wagner, David (2005). "Fixing races for fun and profit: how to abuse atime". Proceedings of the 14th Conference on USENIX Security Symposium, Baltimore (MD), July 31 – August 5, 2005. pp. 303–314.
Jump up ^ Xiang Cai; Yuwei Gui; Johnson, Rob (2009-03-06). "Exploiting Unix File-System Races via Algorithmic Complexity Attacks" (PDF). Proceedings of the IEEE Symposium on Security and Privacy, Berkeley (CA), May 17–20, 2009.
Jump up ^ Martelli, Alex (2006). "Chapter 6: Exceptions". Python in a Nutshell (2nd ed.). O'Reilly Media. p. 134. ISBN 978-0-596-10046-9.
Jump up ^ Dean, Drew; Hu, Alan J. (2004). "Abstract Fixing Races for Fun and Profit: How to use access(2)". Proceedings of the 13th USENIX Security Symposium, San Diego (CA), August 9–13, 2004. pp. 195–206.
Jump up ^ Tsafrir, Dan; Hertz, Tomer; Wagner, David; Da Silva, Dilma (June 2008). "Portably Preventing File Race Attacks with User-Mode Path Resolution". Technical Report RC24572, IBM T. J. Watson Research Center, Yorktown Heights (NY).
Jump up ^ Spillane, Richard P.; Gaikwad, Sachin; Chinni, Manjunath; Zadok, Erez (2009). "Enabling Transactional File Access via Lightweight Kernel Extensions" (PDF). Seventh USENIX Conference on File and Storage Technologies (FAST 2009), San Francisco (CA), February 24–27, 2009.
Jump up ^ Porter, Donald E.; Hofmann, Owen S.; Rossbach, Christopher J.; Benn, Alexander; Witchel, Emmett (2009). "Operating System Transactions" (PDF). Proceedings of the 22nd ACM Symposium on Operating Systems Principles (SOSP '09), Big Sky (MT), October 11–14, 2009.
Jump up ^ Russinovich, Mark; Solomon, David A. (2009). Windows Internals. Microsoft Press. ISBN 978-0735648739.
Jump up ^ "Alternatives to using Transactional NTFS". Microsoft Developer Network. Retrieved 10 December 2015.
Jump up ^ Hao Chen; Wagner, David; Dean, Drew (2002-05-12). "Setuid Demystified" (PDF).
Further reading[edit]
Bishop, Matt; Dilger, Michael (1996). "Checking for Race Conditions in File Accesses" (PDF). Computing Systems. pp. 131–152.
Tsafrir, Dan; Hertz, Tomer; Wagner, David; Da Silva, Dilma (2008). "Portably Solving File TOCTTOU Races with Hardness Amplification" (PDF). Proceedings of the 6th USENIX Conference on File and Storage Technologies (FAST '08), San Jose (CA), February 26–29, 2008. pp. 189–206.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Time_of_check_to_time_of_use&oldid=807308892"
Categories:
Computer security exploits
Navigation menu
Personal tools
Not logged in
Talk
Contributions
Create account
Log in
Namespaces
Article
Talk
Variants
Views
Read
Edit
View history
More
Search
Navigation
Main page
Contents
Featured content
Current events
Random article
Donate to Wikipedia
Wikipedia store
Interaction
Help
About Wikipedia
Community portal
Recent changes
Contact page
Tools
What links here
Related changes
Upload file
Special pages
Permanent link
Page information
Wikidata item
Cite this page
Print/export
Create a book
Download as PDF
Printable version
Languages
Deutsch
فارسی
日本語
Edit links
This page was last edited on 27 October 2017, at 04:52.
Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Developers
Cookie statement
Mobile view
Enable previews

values: mw-page-base noprint

values: mw-head-base noprint

values: firstHeading firstHeading en

values: siteSub noprint

values: jump-to-nav mw-jump

value: p

values:
/wiki/Unix_domain_sockets
mw-redirect
Unix domain sockets

values:
/wiki/Real_userid
mw-redirect
Real userid

values:
/wiki/Effective_userid
mw-redirect
Effective userid

values:
nofollow
external text
http://linux.die.net/man/3/mktemp

values:
catlinks mw-normal-catlinks
catlinks mw-normal-catlinks
interface

values: Discussion about edits from this IP address [ctrl-alt-n]

values: A list of edits made from this IP address [ctrl-alt-y]

values: You are encouraged to create an account and log in; however, it is not mandatory

values: You're encouraged to log in; however, it's not mandatory. [ctrl-alt-o]

values:
/wiki/Time_of_check_to_time_of_use
View the content page [ctrl-alt-c]
c

values: Discussion about the content page [ctrl-alt-t]

values: p-namespaces navigation vectorTabs p-namespaces-label

values:
p-variants
navigation
vectorMenu emptyPortlet
p-variants-label

values: Past revisions of this page [ctrl-alt-h]

values: p-views navigation vectorTabs p-views-label

values:
p-cactions
navigation
vectorMenu emptyPortlet
p-cactions-label

values:
mw-wiki-logo
/wiki/Main_Page
Visit the main page

values:
/wiki/Main_Page
Visit the main page [ctrl-alt-z]
z

values: Featured content – the best of Wikipedia

values: Find background information on current events

values:
/wiki/Special:Random
Load a random article [ctrl-alt-x]
x

values: portal navigation p-navigation p-navigation-label

values: Guidance on how to use and edit Wikipedia

values: About the project, what you can do, where to find things

values: A list of recent changes in the wiki [ctrl-alt-r]

values: portal navigation p-interaction p-interaction-label

values: List of all English Wikipedia pages containing links to this page [ctrl-alt-j]

values: Recent changes in pages linked from this page [ctrl-alt-k]

values:
/wiki/Wikipedia:File_Upload_Wizard
Upload files [ctrl-alt-u]
u

values: A list of all special pages [ctrl-alt-q]

values: Permanent link to this revision of the page

values: Link to connected data repository item [ctrl-alt-g]

values: Printable version of this page [ctrl-alt-p]

values:
uls-settings-trigger
Language settings
0
button
true

values: زمان بررسی تا زمان استفاده – Persian

values: /static/images/wikimedia-button-1.5x.png 1.5x, /static/images/wikimedia-button-2x.png 2x

values: /static/images/poweredby_mediawiki_132x47.png 1.5x, /static/images/poweredby_mediawiki_176x62.png 2x

values:
suggestions
display: none; font-size: 13px;

values: mediawiki ltr sitedir-ltr mw-hide-empty-elt ns-0 ns-subject page-Time_of_check_to_time_of_use rootpage-Time_of_check_to_time_of_use skin-vector action-view