TOCTOU

TOCTOU, short for time-of-check to time-of-use, is a class of race condition in which a program makes a decision based on a condition that can change before the action using that information is carried out. The pattern involves a check phase (time of check) followed by a use phase (time of use). If another process or thread alters the resource in between, the invariant assumed at check time may no longer hold, leading to errors, inconsistency, or security breaches.

Common domains for TOCTOU bugs include file systems and resources managed by the operating system. For example, a program might check whether a file exists and that the user has permission, then open the file. Between the check and the open, another process could replace the file, remove it, or alter permissions, causing the open to succeed or fail inappropriately. Similar issues arise when checking a resource’s state and then performing an action based on that state, or when a privileged program checks a condition and then proceeds without preventing concurrent changes.

Mitigation focuses on making the check and use atomic or tightly synchronized. Approaches include using atomic system calls or operations that combine check and use, acquiring locks around the entire sequence, or using patterns that avoid separate checks (for example, creating or opening a resource in a single atomic step, using file system tricks like O_CREAT/O_EXCL, or performing the critical work inside a locked region). In security-sensitive contexts, TOCTOU is a common source of vulnerabilities and is especially problematic in setuid or privileged programs.

See also: race condition, atomicity, synchronization.