CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

最新推荐文章于 2025-06-06 15:24:19 发布

fallblood

最新推荐文章于 2025-06-06 15:24:19 发布

阅读量1.9k

点赞数

分类专栏：转载文章文章标签： variables resources access

转载文章专栏收录该内容

4 篇文章

订阅专栏

本文探讨了软件安全中一种常见的弱点——TOCTTOU（Time of Check to Time of Use）。这种弱点发生在软件检查资源状态与使用资源之间的时间窗口内，资源的状态被恶意改变，导致软件行为异常，可能使攻击者获取未授权访问权限。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

http://cwe.mitre.org/data/definitions/367.html

Description

Summary

The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.

Extended Description

This weakness can be security-relevant when an attacker can influence the state of the resource between check and use. This can happen with shared resources such as files, memory, or even variables in multi-threaded programs.

Alternate Terms

TOCTTOU

The TOCCTOU acronym expands to "Time Of Check To Time Of Use". Usage varies between TOCTOU and TOCTTOU.

Time of Introduction

Implementation

Applicable Platforms

Languages

All

Common Consequences

Access Control

The attacker can gain access to otherwise unauthorized resources.