CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

http://cwe.mitre.org/data/definitions/367.html

Description

Summary

The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.

Extended Description

This weakness can be security-relevant when an attacker can influence the state of the resource between check and use. This can happen with shared resources such as files, memory, or even variables in multi-threaded programs.

Alternate Terms

TOCTTOU

The TOCCTOU acronym expands to "Time Of Check To Time Of Use". Usage varies between TOCTOU and TOCTTOU.

Time of Introduction

 Implementation

Applicable Platforms

Languages

All

Common Consequences

Access Control

The attacker can gain access to otherwise unauthorized resources.