SY0-701 Question 81
Single answerApplication: Memory injection , Buffer overflow , Race conditions , Time-of-check (TOC) , Time-of-use (TOU) , Malicious updateA development team maintains a Linux-based billing application that runs a scheduled script every minute as root. The script first checks whether /var/billing/incoming/report.tmp is owned by the billing service account and then, if the check passes, moves the file into a protected processing directory and imports it. During a security review, an analyst demonstrates that they can rapidly replace report.tmp with a symbolic link to /etc/shadow after the ownership check but before the move occurs. Which vulnerability best describes this issue?
- A
Buffer overflow
- B
Memory injection
- C
Race condition leading to a time-of-check to time-of-use (TOCTOU) flaw
- D
Malicious update
Show answer and explanation
Correct answer: C
Explanation
The best answer is a race condition leading to a TOCTOU flaw. In secure software design, validating a resource and then later using it by pathname can be dangerous if an attacker can modify the resource or the reference in between those steps. Symbolic link swaps are a well-known example of TOCTOU exploitation on Unix-like systems, especially when privileged code runs with elevated permissions. Best practices include opening the file once and performing checks on the opened file descriptor, avoiding separate check/use steps, using secure temporary file creation methods, limiting symlink following where appropriate, and running scheduled jobs with the least privilege possible. Guidance from secure coding standards such as CERT and common OS hardening recommendations consistently warns against pathname-based check-then-use patterns for privileged file operations.
- A. Incorrect.
Incorrect. A buffer overflow occurs when a program writes more data to a buffer than it can hold, potentially overwriting adjacent memory and enabling crashes or code execution. The scenario does not involve oversized input corrupting memory; it involves unsafe file handling between validation and use.
- B. Incorrect.
Incorrect. Memory injection refers to placing malicious code into the memory space of a running process, often to evade detection or hijack execution. Nothing in the scenario describes code being injected into process memory. The exploit uses filesystem manipulation with a symbolic link after a validation step.
- C. Correct.
Correct. This is a classic race condition, specifically a time-of-check to time-of-use (TOCTOU) vulnerability. The script checks the file's ownership and then later uses the file, but an attacker can change what the pathname refers to between those two operations. Because the file is handled by path rather than by a securely opened file descriptor, the attacker wins the race and causes the privileged process to act on a different object than the one originally checked.
- D. Incorrect.
Incorrect. A malicious update attack involves tampering with software or update packages, such as compromising a vendor update channel or pushing trojanized patches. The billing script problem is unrelated to software distribution or update integrity.