.1 200 OK date: Wed, 01 Jul 2026 23:20:40 GMT server: ATS/9.2.13 x-content-type-options: nosniff content-language: en accept-ch: reporting-endpoints: csp-report-to-endpoint='/w/api.php?action=cspreport&format=json'; content-security-policy: script-src 'unsafe-eval' blob: 'self' meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org mediawiki.org wikimedia.org *.wmflabs.org *.wmcloud.org *.toolforge.org wss://*.toolforge.org *.jsdelivr.net unpkg.com cdnjs.cloudflare.com raw.githubusercontent.com *.github.com code.jquery.com cdn.mathjax.org use.typekit.net fonts.cdnfonts.com use.fontawesome.com i.ytimg.com rsms.me doi.org localhost https://localhost:* http://localhost:* wss://localhost:* ws://localhost:* *.google.com *.gstatic.com *.googleapis.com *.translate.yandex.net yastatic.net ya.ru radically.github.io cdn.sammdot.ca cdn.fontshare.com viaf.org publicai-proxy.alaexis.workers.dev iiif.archive.org api.flickr.com live.staticflickr.com api.anthropic.com api.openai.com api.publicai.co catalogo.pusc.it parsifal.urbe.it opac.sbn.it overpass-api.de api.openrouteservice.org archive.org *.openstreetmap.org *.waymarkedtrails.org *.thunderforest.com registry.ipe.wiki analytics.ipe.wiki qlever.dev app.goacoustic.com wikipedia-archive.ourworldindata.org api.inaturalist.org inaturalist-open-data.s3.amazonaws.com validator.w3.org db.onlinewebfonts.com fontlibrary.org 'unsafe-inline' auth.wikimedia.org; default-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org mediawiki.org wikimedia.org *.wmflabs.org *.wmcloud.org *.toolforge.org wss://*.toolforge.org *.jsdelivr.net unpkg.com cdnjs.cloudflare.com raw.githubusercontent.com *.github.com code.jquery.com cdn.mathjax.org use.typekit.net fonts.cdnfonts.com use.fontawesome.com i.ytimg.com rsms.me doi.org localhost https://localhost:* http://localhost:* wss://localhost:* ws://localhost:* *.google.com *.gstatic.com *.googleapis.com *.translate.yandex.net yastatic.net ya.ru radically.github.io cdn.sammdot.ca cdn.fontshare.com viaf.org publicai-proxy.alaexis.workers.dev iiif.archive.org api.flickr.com live.staticflickr.com api.anthropic.com api.openai.com api.publicai.co catalogo.pusc.it parsifal.urbe.it opac.sbn.it overpass-api.de api.openrouteservice.org archive.org *.openstreetmap.org *.waymarkedtrails.org *.thunderforest.com registry.ipe.wiki analytics.ipe.wiki qlever.dev app.goacoustic.com wikipedia-archive.ourworldindata.org api.inaturalist.org inaturalist-open-data.s3.amazonaws.com validator.w3.org db.onlinewebfonts.com fontlibrary.org en.wikibooks.org en.wikinews.org en.wikiquote.org en.wikisource.org en.wikiversity.org en.wikivoyage.org en.wiktionary.org www.mediawiki.org commons.wikimedia.org foundation.wikimedia.org incubator.wikimedia.org species.wikimedia.org wikimania.wikimedia.org www.wikidata.org www.wikifunctions.org auth.wikimedia.org; style-src 'self' data: blob: upload.wikimedia.org https://commons.wikimedia.org meta.wikimedia.org *.wikimedia.org *.wikipedia.org *.wikinews.org *.wiktionary.org *.wikibooks.org *.wikiversity.org *.wikisource.org wikisource.org *.wikiquote.org *.wikidata.org *.wikifunctions.org *.wikivoyage.org *.mediawiki.org mediawiki.org wikimedia.org *.wmflabs.org *.wmcloud.org *.toolforge.org wss://*.toolforge.org *.jsdelivr.net unpkg.com cdnjs.cloudflare.com raw.githubusercontent.com *.github.com code.jquery.com cdn.mathjax.org use.typekit.net fonts.cdnfonts.com use.fontawesome.com i.ytimg.com rsms.me doi.org localhost https://localhost:* http://localhost:* wss://localhost:* ws://localhost:* *.google.com *.gstatic.com *.googleapis.com *.translate.yandex.net yastatic.net ya.ru radically.github.io cdn.sammdot.ca cdn.fontshare.com viaf.org publicai-proxy.alaexis.workers.dev iiif.archive.org api.flickr.com live.staticflickr.com api.anthropic.com api.openai.com api.publicai.co catalogo.pusc.it parsifal.urbe.it opac.sbn.it overpass-api.de api.openrouteservice.org archive.org *.openstreetmap.org *.waymarkedtrails.org *.thunderforest.com registry.ipe.wiki analytics.ipe.wiki qlever.dev app.goacoustic.com wikipedia-archive.ourworldindata.org api.inaturalist.org inaturalist-open-data.s3.amazonaws.com validator.w3.org db.onlinewebfonts.com fontlibrary.org 'unsafe-inline'; object-src 'none'; report-uri /w/api.php?action=cspreport&format=json; report-to csp-report-to-endpoint last-modified: Fri, 19 Jun 2026 16:39:13 GMT content-type: text/html; charset=UTF-8 age: 49398 accept-ranges: bytes x-cache: cp2047 hit, cp2047 hit/1 x-cache-status: hit-front server-timing: cache;desc="hit-front", host;desc="cp2047" strict-transport-security: max-age=106384710; includeSubDomains; preload report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] } nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0} set-cookie: WMF-Last-Access=02-Jul-2026;Path=/;HttpOnly;secure;Expires=Mon, 03 Aug 2026 12:00:00 GMT set-cookie: WMF-Last-Access-Global=02-Jul-2026;Path=/;Domain=.wikipedia.org;HttpOnly;secure;Expires=Mon, 03 Aug 2026 12:00:00 GMT set-cookie: WMF-DP=f19;Path=/;HttpOnly;secure;Expires=Fri, 03 Jul 2026 00:00:00 GMT x-client-ip: 75.28.18.94 cache-control: private, s-maxage=0, max-age=0, must-revalidate, no-transform vary: Accept-Encoding,X-Subdomain,Cookie,Authorization,User-Agent set-cookie: GeoIP=US:TX:McKinney:33.20:-96.62:v4; Path=/; secure; Domain=.wikipedia.org set-cookie: NetworkProbeLimit=0.001;Path=/;Secure;SameSite=None;Max-Age=3600 set-cookie: WMF-Uniq=og_UCKGURyUuS3TBtWyKvAORAAAAAFvdAS7sBHhRDbEhYEqiVMv4eithHrp64O8W;Domain=.wikipedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Fri, 02 Jul 2027 00:00:00 GMT content-length: 108607 x-request-id: 3fd3270d-4eea-47c2-afdf-8c9be81d2cf7 x-analytics: Time-of-check to time-of-use - Wikipedia Jump to content Main menu Main menu move to sidebar hide Navigation Main page Contents Current events Random article About Wikipedia Contact us Contribute Help Learn to edit Community portal Recent changes Upload file Special pages Search Search Appearance Donate Create account Log in Personal tools Donate Create account Log in Contents move to sidebar hide (Top) 1 Description 2 Examples 3 Reliably timing TOCTOU 4 Preventing TOCTOU 5 Real-world consequences 6 See also 7 References 8 Further reading Toggle the table of contents Time-of-check to time-of-use 6 languages العربية Deutsch Ελληνικά فارسی עברית 日本語 Edit links Article Talk English Read Edit View history Tools Tools move to sidebar hide Actions Read Edit View history General What links here Related changes Upload file Permanent link Page information Cite this page Get shortened URL Print/export Download as PDF Printable version In other projects Wikidata item Appearance move to sidebar hide From Wikipedia, the free encyclopedia Class of software bugs In software development , time-of-check to time-of-use ( TOCTOU , TOCTTOU or TOC/TOU ) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. TOCTOU race conditions are common in Unix between operations on the file system , [ 1 ] but can occur in other contexts, including local sockets and improper use of database transactions . In the early 1990s, the mail utility of BSD 4.3 UNIX had an exploitable race condition for temporary files because it used the mktemp() [ 2 ] function. [ 3 ] Early versions of OpenSSH had an exploitable race condition for Unix domain sockets . [ 4 ] They remain a problem in modern systems; as of 2019, a TOCTOU race condition in Docker allows root access to the filesystem of the host platform. [ 5 ] In the 2023 Pwn2Own competition in Vancouver, a team of hackers were able to compromise the gateway in an updated Tesla Model 3 using this bug. [ 6 ] In 2025, a TOCTOU race condition in Amazon Web Services ' DNS management system for DynamoDB caused a major outage across the US-EAST-1 region. The incident stemmed from outdated DNS plans being applied after newer ones had already been cleaned up, resulting in the deletion of endpoint IP addresses and widespread service failure. [ 7 ] Description [ edit ] A program is vulnerable to a TOCTOU race condition if it does the following Checks some property or validates some data Takes some action based on this information and the following are the case Non-atomic: It's possible for other programs that run concurrently with this program to execute in between steps 1 and 2 Outside control: Other programs can change the property or data Then, if another process does in fact change the property between step 1 and 2, step 2 is performed based on outdated information, which can have unintended consequences. If the program running is privileged, and an unprivileged process can affect the property, it can effectively execute certain privileged tasks. In particular, if the property checks whether some action is allowed, and thereby implements a security boundary, such as a permissions check, this permissions check can then be bypassed completely, and a variety of privileged actions can be executed this way ( privilege escalation ). Examples [ edit ] This section does not cite any sources . Please help improve this section by adding citations to reliable sources . Unsourced material may be challenged and removed . ( July 2022 ) ( Learn how and when to remove this message ) In Unix , the following C code, when used in a setuid program, has a TOCTOU bug: if ( access ( "file" , W_OK ) != 0 ) { exit ( 1 ); } fd = open ( "file" , O_WRONLY ); write ( fd , buffer , sizeof ( buffer )); Here, access is intended to check whether the real user who executed the setuid program would normally be allowed to write the file (i.e., access checks the real userid rather than effective userid ). This race condition is vulnerable to an attack: Victim Attacker if ( access ( "file" , W_OK ) != 0 ) { exit ( 1 ); } After the access check, before the open, the attacker replaces file with a symlink to the Unix password file /etc/passwd : symlink ( "/etc/passwd" , "file" ); fd = open ( "file" , O_WRONLY ); write ( fd , buffer , sizeof ( buffer )); Actually writing over /etc/passwd In this example, an attacker can exploit the race condition between the access and open to trick the setuid victim into overwriting an entry in the system password database. TOCTOU races can be used for privilege escalation to get administrative access to a machine. Although this sequence of events requires precise timing, it is possible for an attacker to arrange such conditions without too much difficulty. The implication is that applications cannot assume the state managed by the operating system (in this case the file system namespace) will not change between system calls. Reliably timing TOCTOU [ edit ] Exploiting a TOCTOU race condition requires precise timing to ensure that the attacker's operations interleave properly with the victim's. In the example above, the attacker must execute the symlink system call precisely between the access and open . For the most general attack, the attacker must be scheduled for execution after each operation by the victim, also known as "single-stepping" the victim. In the case of BSD 4.3 mail utility and mktemp() , [ 2 ] the attacker can simply keep launching mail utility in one process, and keep guessing the temporary file names and keep making symlinks in another process. The attack can usually succeed in less than one minute. Techniques for single-stepping a victim program include file system mazes [ 8 ] and algorithmic complexity attacks. [ 9 ] In both cases, the attacker manipulates the OS state to control scheduling of the victim. File system mazes force the victim to read a directory entry that is not in the OS cache, and the OS puts the victim to sleep while it is reading the directory from disk. Algorithmic complexity attacks force the victim to spend its entire scheduling quantum inside a single system call traversing the kernel's hash table of cached file names. The attacker creates a very large number of files with names that hash to the same value as the file the victim will look up. Preventing TOCTOU [ edit ] Despite conceptual simplicity, TOCTOU race conditions are difficult to avoid and eliminate. One general technique is to use error handling instead of pre-checking, under the philosophy of EAFP – "It is easier to ask for forgiveness than permission" – rather than LBYL – "look before you leap". In this case there is no check, and failure of assumptions to hold are signaled by an error being returned. [ 10 ] In the context of file system TOCTOU race conditions, the fundamental challenge is ensuring that the file system cannot be changed between two system calls. In 2004, an impossibility result was published, showing that there was no portable, deterministic technique for avoiding TOCTOU race conditions when using the Unix access and open filesystem calls. [ 11 ] Since this impossibility result, libraries for tracking file descriptors and ensuring correctness have been proposed by researchers. [ 12 ] An alternative solution proposed in the research community is for Unix systems to adopt transactions in the file system or the OS kernel. Transactions provide a concurrency control abstraction for the OS, and can be used to prevent TOCTOU races. While no production Unix kernel has yet adopted transactions, proof-of-concept research prototypes have been developed for Linux, including the Valor file system [ 13 ] and the TxOS kernel. [ 14 ] Microsoft Windows has added transactions to its NTFS file system, [ 15 ] but Microsoft discourages their use, and has indicated that they may be removed in a future version of Windows. [ 16 ] File locking is a common technique for preventing race conditions for a single file, but it does not extend to the file system namespace and other metadata, nor does locking work well with networked filesystems, and cannot prevent TOCTOU race conditions. For setuid binaries, a possible solution is to use the seteuid() system call to change the effective user and then perform the open() call. Differences in setuid() between operating systems can be problematic. [ 17 ] Real-world consequences [ edit ] TOCTOU vulnerabilities have caused significant outages in large-scale systems. In October 2025, AWS experienced a major disruption due to a race condition in its DNS management system for DynamoDB. The incident involved outdated DNS plans being applied after newer ones had already been cleaned up, leading to the deletion of endpoint IPs and widespread service failure. [ 18 ] See also [ edit ] Linearizability References [ edit ] ^ Wei, Jinpeng; Pu, Calton (December 2005). "TOCTTOU Vulnerabilities in UNIX-Style File Systems: An Anatomical Study" . USENIX . Retrieved 2019-01-14 . ^ a b "mktemp(3)" . Linux manual page . 2017-09-15. ^ Shangde Zhou(周尚德) (1991-10-01). "A Security Loophole in Unix" . {{ cite web }} : CS1 maint: deprecated archival service ( link ) ^ Acheson, Steve (1999-11-04). "The Secure Shell (SSH) Frequently Asked Questions" . Archived from the original on 2017-02-13. ^ "Docker Bug Allows Root Access to Host File System" . Decipher . Duo Security. 28 May 2019 . Retrieved 2019-05-29 . ^ "Windows 11, Tesla, Ubuntu, and macOS hacked at Pwn2Own 2023" . BleepingComputer . Retrieved 2023-03-24 . ^ "AWS Service Event in the US-EAST-1 Region" . Amazon Web Services . 2025-10-27 . Retrieved 2025-10-30 . ^ Borisov, Nikita; Johnson, Rob; Sastry, Naveen; Wagner, David (August 2005). "Fixing races for fun and profit: how to abuse atime". Proceedings of the 14th Conference on USENIX Security Symposium . 14 . Baltimore, MD: USENIX Association: 303– 314. CiteSeerX   10.1.1.117.7757 . ^ Xiang Cai; Yuwei Gui; Johnson, Rob (May 2009). "Exploiting Unix File-System Races via Algorithmic Complexity Attacks" (PDF) . 2009 30th IEEE Symposium on Security and Privacy . Berkeley, CA: IEEE Computer Society. pp.  27– 41. doi : 10.1109/SP.2009.10 . ISBN   978-0-7695-3633-0 . S2CID   6393789 . Archived from the original (PDF) on 2021-05-18. ^ Martelli, Alex (2006). "Chapter 6: Exceptions". Python in a Nutshell (2 ed.). O'Reilly Media . p. 134. ISBN   978-0-596-10046-9 . ^ Dean, Drew; Hu, Alan J. (August 2004). "Fixing Races for Fun and Profit: How to use access(2)". Proceedings of the 13th USENIX Security Symposium . San Diego, CA): 195– 206. CiteSeerX   10.1.1.83.8647 . ^ Tsafrir, Dan; Hertz, Tomer; Wagner, David; Da Silva, Dilma (June 2008). "Portably Preventing File Race Attacks with User-Mode Path Resolution" . Technical Report RC24572, IBM T. J. Watson Research Center . Yorktown Heights, NY. ^ Spillane, Richard P.; Gaikwad, Sachin; Chinni, Manjunath; Zadok, Erez (February 24–27, 2009). "Enabling Transactional File Access via Lightweight Kernel Extensions" (PDF) . Seventh USENIX Conference on File and Storage Technologies (FAST 2009) . San Francisco, CA. ^ Porter, Donald E.; Hofmann, Owen S.; Rossbach, Christopher J.; Benn, Alexander; Witchel, Emmett (October 11–14, 2009). "Operating System Transactions" (PDF) . Proceedings of the 22nd ACM Symposium on Operating Systems Principles (SOSP '09) . Big Sky, MT. ^ Russinovich, Mark; Solomon, David A. Windows Internals . Microsoft Press . ISBN   978-0735648739 . ^ "Alternatives to using Transactional NTFS" . Microsoft Developer Network . Archived from the original on 29 September 2022 . Retrieved 10 December 2015 . ^ Hao Chen; Wagner, David; Dean, Drew (2002-05-12). "Setuid Demystified" (PDF) . ^ "AWS Service Event in the US-EAST-1 Region" . Amazon Web Services . 2025-10-27 . Retrieved 2025-10-30 . Further reading [ edit ] Bishop, Matt; Dilger, Michael (1996). "Checking for Race Conditions in File Accesses" (PDF) . Computing Systems . pp.  131– 152. Tsafrir, Dan; Hertz, Tomer; Wagner, David; Da Silva, Dilma (2008). "Portably Solving File TOCTTOU Races with Hardness Amplification" (PDF) . Proceedings of the 6th USENIX Conference on File and Storage Technologies (FAST '08), San Jose (CA), February 26–29, 2008 . pp.  189– 206. Retrieved from " https://en.wikipedia.org/w/index.php?title=Time-of-check_to_time-of-use&oldid=1355882868 " Categories : Computer security exploits Software bugs Hidden categories: CS1 maint: deprecated archival service Articles with short description Short description matches Wikidata Articles needing additional references from July 2022 All articles needing additional references This page was last edited on 24 May 2026, at 13:17  (UTC) . Text is available under the Creative Commons Attribution-ShareAlike 4.0 License ; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy . Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc. , a non-profit organization. Privacy policy About Wikipedia Disclaimers Contact Wikipedia Legal & safety contacts Code of Conduct Developers Statistics Cookie statement Mobile view Search Search Toggle the table of contents Time-of-check to time-of-use 6 languages Add topic