911
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 361 7PK - Time and State 700 2320
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 884 CWE Cross-section 884 2567
MemberOf 988 SFP Secondary Cluster: Race Condition Window 888 2412
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
Notes
Relationship
TOCTOU issues do not always involve symlinks, and not every symlink issue is a TOCTOU
problem.
Research Gap
Non-symlink TOCTOU issues are not reported frequently, but they are likely to occur in code that
attempts to be secure.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Time-of-check Time-of-use race
condition
7 Pernicious Kingdoms File Access Race Conditions: TOCTOU
CLASP Time of check, time of use race
condition
CLASP Race condition in switch
CERT C Secure Coding FIO01-C Be careful using functions that use file
names for identification
Software Fault Patterns SFP20 Race Condition Window
Related Attack Patterns
CAPEC-ID Attack Pattern Name
27 Leveraging Race Conditions via Symbolic Links
29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
References
[REF-18]Secure Software, Inc.. "The CLASP Application Security Process". 2005. < https://
cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf >.
[REF-367]Dan Tsafrir, Tomer Hertz, David Wagner and Dilma Da Silva. "Portably Solving File
TOCTTOU Races with Hardness Amplification". 2008 February 8. < https://www.usenix.org/legacy/
events/fast08/tech/tsafrir.html >.2023-04-07.
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-62]Mark Dowd, John McDonald and Justin Schuh. "The Art of Software Security
Assessment". 1st Edition. 2006. Addison Wesley.
CWE Version 4.14
CWE-368: Context Switching Race Condition
CWE-368: Context Switching Race Condition