906
Nature Type ID Name Page
MemberOf 748 CERT C Secure Coding Standard (2008) Appendix -
POSIX (POS)
734 2351
MemberOf 852 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 9 - Visibility and Atomicity (VNA)
844 2366
MemberOf 882 CERT C++ Secure Coding Section 14 - Concurrency
(CON)
868 2380
MemberOf 986 SFP Secondary Cluster: Missing Lock 888 2411
MemberOf 1142 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 08. Visibility and Atomicity (VNA)
1133 2448
MemberOf 1169 SEI CERT C Coding Standard - Guidelines 14.
Concurrency (CON)
1154 2462
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CLASP Race condition within a thread
CERT C Secure Coding CON32-
C
CWE More
Abstract
Prevent data races when accessing bitfields
from multiple threads
CERT C Secure Coding CON40-
C
CWE More
Abstract
Do not refer to an atomic variable twice
in an expression
CERT C Secure Coding CON43-
C
Exact Do not allow data races in
multithreaded code
The CERT Oracle Secure
Coding Standard for Java
(2011)
VNA02-J Ensure that compound operations on
shared variables are atomic
The CERT Oracle Secure
Coding Standard for Java
(2011)
VNA03-J Do not assume that a group of calls
to independently atomic methods is
atomic
Software Fault Patterns SFP19 Missing Lock
Related Attack Patterns
CAPEC-ID Attack Pattern Name
26 Leveraging Race Conditions
29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
Weakness ID : 367
Structure : Simple
Abstraction : Base
Description
CWE Version 4.14
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition