SY0-701 Question 82
Single answerApplication: Memory injection , Buffer overflow , Race conditions , Time-of-check (TOC) , Time-of-use (TOU) , Malicious updateA development team releases a Linux-based finance application that runs with elevated privileges to write reports into a protected directory. During a security assessment, an analyst finds that the application first verifies that a user-supplied file path points to a permitted temporary file and then, a moment later, opens that same path for writing. By rapidly replacing the temporary file with a symbolic link between the verification step and the write operation, the analyst is able to overwrite a sensitive system file. Which vulnerability best describes this issue?
- A
Buffer overflow
- B
Memory injection
- C
Race condition leading to a time-of-check/time-of-use (TOC/TOU) flaw
- D
Malicious update
- E
Cross-site scripting
Show answer and explanation
Correct answer: C
Explanation
The best answer is a race condition leading to a time-of-check/time-of-use (TOC/TOU) flaw. TOC/TOU issues occur when a program validates a resource and then later uses that resource, assuming it has not changed. Attackers exploit the time window between those steps by swapping the target file, changing permissions, or redirecting a path with a symbolic link. In privileged applications, this can lead to unauthorized file overwrite or privilege escalation. Secure coding guidance from sources such as the Open Worldwide Application Security Project (OWASP) and MITRE CWE identifies this pattern under race conditions, commonly including CWE-367 (Time-of-check Time-of-use Race Condition). Best practices include using atomic operations, securely opening files without following symlinks where appropriate, validating and operating on the same file descriptor rather than reusing a path string, minimizing privileged operations, and avoiding separate check-then-use logic for security-sensitive resources.
- A. Incorrect.
Incorrect. A buffer overflow occurs when a program writes more data into a buffer than it can hold, potentially overwriting adjacent memory and enabling code execution or crashes. In this scenario, the issue is not caused by excessive input length or memory corruption. The exploit depends on changing the file state between validation and use, not overflowing memory.
- B. Incorrect.
Incorrect. Memory injection typically refers to inserting malicious code into the address space of another process, such as DLL injection or process hollowing. Although memory injection is a real application attack technique, the scenario here involves unsafe file handling and a timing window between two operations rather than injecting code into a running process.
- C. Correct.
Correct. This is a classic race condition with a time-of-check/time-of-use flaw. The application checks whether the file path is safe and permitted, but it uses the path later, after an attacker has changed what that path references. Replacing the file with a symbolic link between the check and the write allows the attacker to redirect the privileged write operation to a sensitive file. This is a practical example of TOC/TOU exploitation.
- D. Incorrect.
Incorrect. A malicious update involves distributing or installing a compromised software update, often through a supply-chain attack or tampered package. Nothing in the scenario indicates the application or its dependencies were updated with malicious code. The problem is the unsafe gap between validation and file access.
- E. Incorrect.
Incorrect. Cross-site scripting is a web application vulnerability in which attacker-supplied script executes in a victim's browser. This scenario involves a local privileged file operation on Linux and symbolic link manipulation, so XSS does not apply.