Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
We track 353 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.7. 7 have been exploited in real attacks.
How this weakness is prevented
- Implementation: The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
- Implementation: When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
- Architecture and Design: Limit the interleaving of operations on files from multiple processes.
- Implementation Architecture and Design: If you cannot perform operations atomically and you must share access to the resource between multiple processes or threads, then try to limit the amount of time (CPU cycles) between the check and use of the resource. This will not fix the problem, but it could make it more difficult for an attack to succeed.
- Implementation: Recheck the resource after the use call to verify that the action was taken appropriately.
Latest Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities
- 7.0 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upon resume from hibernation on my laptop. The reason seems to be a stale interrupt which isn't being cleared out be
- 7.0 High severity
Elefant Software Updater: Time-of-check Time-of-use (TOCTOU) Race Condition
An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a race condition in the Elefant Update Service during the repair or update process. When using the repair function, the
- 7.5 High severity
Antivirus: Time-of-check Time-of-use (TOCTOU) Race Condition
The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time-of-use (TOCTOU) when self protection is disabled.
- 8.3 High severity
Container Toolkit: Time-of-check Time-of-use (TOCTOU) Race Condition
NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases whe
- 9.8 Critical severity
SO Planning: Time-of-check Time-of-use (TOCTOU) Race Condition
A unauthenticated Remote Code Execution (RCE) vulnerability is found in the SO Planning online planning tool. If the public view setting is enabled, a attacker can upload a PHP-file that will be available for execution for a few milliseconds before it is remov
- 7.0 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on succes
- 7.0 High severity
Acrobat Reader: Time-of-check Time-of-use (TOCTOU) Race Condition
Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-p
- 7.0 High severity
Acrobat Reader: Time-of-check Time-of-use (TOCTOU) Race Condition
Acrobat Reader versions 20.005.30636, 24.002.21005, 24.001.30159, 20.005.30655, 24.002.20965, 24.002.20964, 24.001.30123, 24.003.20054 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary co
- 7.5 High severity
PostgreSQL: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often a superuser. The attack involves replacing another relation type with a view or f
- 7.5 High severity
openssh: Time-of-check Time-of-use (TOCTOU) Race Condition
OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObscureKeystrokeTiming logic error. Similarly, other timing attacks against keystroke entry could occur.
- 7.8 High severity
HP PC BIOS: Time-of-check Time-of-use (TOCTOU) Race Condition
A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC products, which might allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate t
- 7.0 High severity
Microsoft Windows Kernel TOCTOU Race Condition Exploited
Windows Kernel Elevation of Privilege Vulnerability
- 7.0 High severity
Trend Micro Apex One: Time-of-check Time-of-use (TOCTOU) Race Condition
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privilege
- 8.2 High severity
Nessus Agent: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus Agent host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host. - CVE-2024-3292
- 8.2 High severity
Nessus: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could modify installation parameters at installation time, which could lead to the execution of arbitrary code on the Nessus host
- 7.4 High severity
ale_300: Time-of-check Time-of-use (TOCTOU) Race Condition
An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. Because of a time-of-check time-of-use vulnerability, an authenticated attacker is able to replace the verifie
- 7.7 High severity
wordops: Time-of-check Time-of-use (TOCTOU) Race Condition
WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter during file creation.
- 8.8 High severity
Model 3: Time-of-check Time-of-use (TOCTOU) Race Condition
Tesla Model 3 Gateway Firmware Signature Validation Bypass Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Tesla Model 3 vehicles. An attacker must first obtain the ability to execute privileged code on
- 7.5 High severity
Desktop: Time-of-check Time-of-use (TOCTOU) Race Condition
Parallels Desktop Toolgate Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute
- 7.8 High severity
Desktop: Time-of-check Time-of-use (TOCTOU) Race Condition
Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute
- 7.0 High severity
Linux: Time-of-check Time-of-use (TOCTOU) Race Condition
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race condition during AER recovery During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data struct
- 8.1 High severity
Client Connector: Time-of-check Time-of-use (TOCTOU) Race Condition
Anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. This affects Zscaler Client Connector on Windows prior to 4.2.1
- 7.5 High severity
Avalanche: Time-of-check Time-of-use (TOCTOU) Race Condition
A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
- 7.5 High severity
Avalanche: Time-of-check Time-of-use (TOCTOU) Race Condition
A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.
- 7.2 High severity
Intel(R) Processors: Time-of-check Time-of-use (TOCTOU) Race Condition
Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
- 8.1 High severity
Focus for iOS: Time-of-check Time-of-use (TOCTOU) Race Condition
An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme and a timeout race condition. This vulnerability affects Focus for iOS < 122.
- 7.5 High severity
FreeBSD: Time-of-check Time-of-use (TOCTOU) Race Condition
The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could lead to kernel memory corruption. On systems configured to include netmap in their devfs_ruleset, a p
- 7.0 High severity
Apple Multiple Products Memory Corruption Exploited
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a re
- 7.0 High severity
Elastic Ci Stack: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permiss
- 7.0 High severity
Enterprise Server: Time-of-check Time-of-use (TOCTOU) Race Condition
A race condition in GitHub Enterprise Server was identified that could allow an attacker administrator access. To exploit this, an organization needs to be converted from a user. This vulnerability affected all versions of GitHub Enterprise Server since 3.7 an
- 8.1 High severity
YASR – Yet Another Star Rating Plugin for…: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue affects YASR – Yet Another Star Rating Plugin for WordPress: from n/a through 3.3.8.
- 7.0 High severity
Avast/Avg Antivirus: Time-of-check Time-of-use (TOCTOU) Race Condition
A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the
- 7.5 High severity
foodcoopshop: Time-of-check Time-of-use (TOCTOU) Race Condition
FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the `/api/updateProducts.json` endpoint to mak
- 7.1 High severity
Vantage HardwareScan Plugin: Time-of-check Time-of-use (TOCTOU) Race Condition
A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete contents of an arbitrary directory under certain conditions.
- 7.8 High severity
Vantage SystemUpdate Plugin: Improper Privilege Management
A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to execute arbitrary code with elevated privileges.
- 7.0 High severity
Secure Access Client: Time-of-check Time-of-use (TOCTOU) Race Condition
A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flow is initiated, an attacker can exploit this condition to gain unauthorized elevated privileges on the affected system.
- 7.0 High severity
Fusion: Time-of-check Time-of-use (TOCTOU) Race Condition
VMware Fusion(13.x prior to 13.5) contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during installation for the first time (the user needs to drag or copy the application to a folder from the '.dmg' volume) or when installing an upgrade.
- 8.1 High severity
Cato Client: Time-of-check Time-of-use (TOCTOU) Race Condition
An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the PrivilegedHelperTool component.
- 7.8 High severity
Synapse: Time-of-check Time-of-use (TOCTOU) Race Condition
Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if
- 7.0 High severity
Cisco IOS XR Software: Time-of-check Time-of-use (TOCTOU) Race Condition
A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on the underlying operating system. This vulnerability is due to a time-of-check, time-of-use (TOCTOU) race condition when