Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CWE-363:Race Condition Enabling Link Following
Weakness ID:363
Version:v4.17
Weakness Name:Race Condition Enabling Link Following
Vulnerability Mapping:Allowed
Abstraction:Base
Structure:Simple
Status:Draft
Likelihood of Exploit:
DetailsContent HistoryObserved CVE ExamplesReports
▼Description

The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.

▼Extended Description

While developers might expect that there is a very narrow time window between the time of check and time of use, there is still a race condition. An attacker could cause the product to slow down (e.g. with memory consumption), causing the time window to become larger. Alternately, in some situations, the attacker could win the race by performing a large number of attacks.

▼Alternate Terms
▼Relationships
Relevant to the view"Research Concepts - (1000)"
NatureMappingTypeIDName
CanPrecedeAllowedB59Improper Link Resolution Before File Access ('Link Following')
ChildOfAllowedB367Time-of-check Time-of-use (TOCTOU) Race Condition
Nature: CanPrecede
Mapping: Allowed
Type: Base
ID: 59
Name: Improper Link Resolution Before File Access ('Link Following')
Nature: ChildOf
Mapping: Allowed
Type: Base
ID: 367
Name: Time-of-check Time-of-use (TOCTOU) Race Condition
▼Memberships
NatureMappingTypeIDName
MemberOfProhibitedC748CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)
MemberOfProhibitedC988SFP Secondary Cluster: Race Condition Window
MemberOfProhibitedC1171SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
MemberOfProhibitedC1401Comprehensive Categorization: Concurrency
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 748
Name: CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 988
Name: SFP Secondary Cluster: Race Condition Window
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1171
Name: SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
Nature: MemberOf
Mapping: Prohibited
Type:Category
ID: 1401
Name: Comprehensive Categorization: Concurrency
▼Tags
NatureMappingTypeIDName
MemberOfProhibitedBSBOSS-294Not Language-Specific Weaknesses
MemberOfProhibitedBSBOSS-319Read Files or Directories (impact)
MemberOfProhibitedBSBOSS-320Modify Files or Directories (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-294
Name: Not Language-Specific Weaknesses
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-319
Name: Read Files or Directories (impact)
Nature: MemberOf
Mapping: Prohibited
Type:BOSSView
ID: BOSS-320
Name: Modify Files or Directories (impact)
▼Relevant To View
Relevant to the view"Weaknesses Addressed by the SEI CERT C Coding Standard - (1154)"
NatureMappingTypeIDName
MemberOfProhibitedC1171SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 1171
Name: SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
Relevant to the view"Software Fault Pattern (SFP) Clusters - (888)"
NatureMappingTypeIDName
MemberOfProhibitedC988SFP Secondary Cluster: Race Condition Window
Nature: MemberOf
Mapping: Prohibited
Type: Category
ID: 988
Name: SFP Secondary Cluster: Race Condition Window
▼Background Detail

▼Common Consequences
ScopeLikelihoodImpactNote
ConfidentialityIntegrityN/ARead Files or DirectoriesModify Files or Directories
N/A
Scope: Confidentiality, Integrity
Likelihood: N/A
Impact: Read Files or Directories, Modify Files or Directories
Note:
N/A
▼Potential Mitigations
▼Modes Of Introduction
Phase: Architecture and Design
Note:

N/A

Phase: Implementation
Note:

N/A

▼Applicable Platforms
Languages
Class: Not Language-Specific(Undetermined Prevalence)
▼Demonstrative Examples
Example 1

This code prints the contents of a file if a user has permission.

Language: ( code)
N/A

Language: PHP(Bad code)
function readFile($filename){ $user = getCurrentUser(); //resolve file if its a symbolic link* if(is_link($filename)){ $filename = readlink($filename); } if(fileowner($filename) == $user){ echo file_get_contents($realFile); return; } else{ echo 'Access denied'; return false; } }

Language: ( code)
N/A

This code attempts to resolve symbolic links before checking the file and printing its contents. However, an attacker may be able to change the file from a real file to a symbolic link between the calls to is_link() and file_get_contents(), allowing the reading of arbitrary files. Note that this code fails to log the attempted access (CWE-778).

▼Observed Examples
ReferenceDescription
▼Affected Resources
    ▼Functional Areas
      ▼Weakness Ordinalities
      OrdinalityDescription
      ▼Detection Methods
      ▼Vulnerability Mapping Notes
      Usage:Allowed
      Reason:Acceptable-Use
      Rationale:

      This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

      Comments:

      Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

      Suggestions:
      ▼Notes
      Relationship

      This is already covered by the "Link Following" weakness (CWE-59). It is included here because so many people associate race conditions with link problems; however, not all link following issues involve race conditions.

      N/A

      ▼Taxonomy Mappings
      Taxonomy NameEntry IDFitEntry Name
      PLOVERN/AN/ARace condition enabling link following
      CERT C Secure CodingPOS35-CExactAvoid race conditions while checking for the existence of a symbolic link
      Software Fault PatternsSFP20N/ARace Condition Window
      Taxonomy Name: PLOVER
      Entry ID: N/A
      Fit: N/A
      Entry Name: Race condition enabling link following
      Taxonomy Name: CERT C Secure Coding
      Entry ID: POS35-C
      Fit: Exact
      Entry Name: Avoid race conditions while checking for the existence of a symbolic link
      Taxonomy Name: Software Fault Patterns
      Entry ID: SFP20
      Fit: N/A
      Entry Name: Race Condition Window
      ▼Related Attack Patterns
      IDName
      CAPEC-26
      Leveraging Race Conditions
      ID: CAPEC-26
      Name: Leveraging Race Conditions
      ▼References
      Reference ID: REF-62
      Title: The Art of Software Security Assessment
      Author: Mark Dowd, John McDonald, Justin Schuh
      Section: Chapter 9, "Race Conditions", Page 526
      Publication:
      Publisher:Addison Wesley
      Edition:1st Edition
      URL:
      URL Date:
      Day:N/A
      Month:N/A
      Year:2006
      Details not found