CWE-367: TOCTTOU
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
Also known as Time-of-check Time-of-use (TOCTOU) Race Condition, TOCCTOU.
A kind of CWE-362 Race Condition.
From the CWE List. © The MITRE Corporation.
Newest
- qualcomm, inc. snapdragon auto, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +110 more +112 moreTime-of-check time-of-use race condition While processing partition entries due to newly created...7.0 High
- pengutronix raucThe install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signature verification on an update file takes place before the fil…6.6 Medium
- medtronic mycarelink smart model 25000 firmware, smart model 25000 patient reader +1 moreMedtronic MyCareLink Smart Time-of-check Time-of-use Race Condition8.8 High
- amd trusted platform modules referenceThe Trusted Platform Modules (TPM) reference software may not properly track the number of times...6.4 Medium
- lenovo bios, notebook firmware +1 moreA potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in...6.4 Medium
- adobe acrobat, acrobat reader, acrobat reader dc +1 more +3 moreAcrobat Reader DC for macOS Race Condition Vulnerability Could Lead to Privilege Escalation7.7 High
- trendmicro antivirus, trend micro antivirus for mac (consumer) +1 moreTrend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web...6.4 Medium
- apple macos, mac os x +1 moreA race condition was addressed with additional validation. This issue is fixed in macOS Catalina...7.8 High
- apple macos, mac os x +1 moreThis issue was addressed with improved checks. This issue is fixed in macOS Catalina 10.15.6. A...6.4 Medium
- apple macos, mac os x +1 moreA memory corruption issue was addressed with improved memory handling. This issue is fixed in...7.0 High
- vmware esxi, fusion, workstation +3 more +5 moreVMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before...7.7 High
- vmware esxi, fusion, workstation +2 more +4 moreVMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804, 6.7 before ESXi670-202008101-SG, 6.5 before...5.8 Medium
- ibm system x, lenovo bladecenter hs23 firmware, bladecenter hs23e firmware +16 more +18 moreA potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers...6.4 Medium
- [unknown] dpdk, canonical ubuntu linux, dpdk data plane development kit +1 more +3 moreA flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors,...7.8 High
- google androidIn SurfaceFlinger, there is a possible use after free due to a race condition. This could lead to...6.4 Medium
- dell system updateA race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106...7.3 High
- debian linux, linux kernel, canonical ubuntu linux +1 more +3 moreA TOCTOU mismatch in the NFS client code in the Linux kernel before 5.8.3 could be used by local...7.0 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +42 more +44 moreu'Non-secure memory is touched multiple times during TrustZone\u2019s execution and can lead to...7.0 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm ipq6018 firmware, kamorta firmware +23 more +25 moreu'While processing SMCInvoke asynchronous message header, message count is modified leading to a...7.0 High
- crayon project crayonMemory safety violation in crayon8.1 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1709 +30 more +32 moreWindows Print Spooler Elevation of Privilege Vulnerability7.8 High
- freebsdIn FreeBSD 12.1-STABLE before r363918, 12.1-RELEASE before p8, 11.4-STABLE before r363919, 11.4...7.0 High
- canonical apport, ubuntu linux +1 moreTOCTOU in apport7.0 High
- google androidIn updatePreferenceIntents of AccountTypePreferenceLoader, there is a possible confused deputy...7.0 High
- oracle vm virtualbox, opensuse leap +1 moreVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....7.5 High
- oracle vm virtualbox, opensuse leap +1 moreVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....7.5 High
- oracle vm virtualbox, opensuse leap +1 moreVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core)....7.5 High
- cisofy lynis, fedoraproject fedora +1 moreCISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The...4.2 Medium
- pulsesecure pulse secure desktop client, pulse secure installer service +1 moreA time-of-check time-of-use vulnerability in PulseSecureService.exe in Pulse Secure Client...7.0 High
- chownr project chownrTime-of-check Time-of-use (TOCTOU) Race Condition in chownr2.5 Low
- google androidIn InstallPackage of package.cpp, there is a possible bypass of a signature check due to a Time...7.0 High
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: File race condition vulnerability leads to local privilege escalation during upgrade7.0 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8009 firmware, apq8053 firmware +16 more +18 moreA race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto,...7.0 High
- vmware fusion, horizon client, remote console +2 more +4 moreVMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware...7.0 High
- opc foundation ua .net standard, opcfoundation unified architecture .net-standard +1 moreInsufficient Session Expiration and TOCTOU Race Condition in OPC FOundation UA .Net Standard5.3 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: Privilege escalation vulnerability in dual REs, VC or HA cluster may allow unauthorized configuration change.5.0 Medium
- opensuse leap, leap 15.1, texlive-filesystem +3 more +5 morerace condition on texlive-filesystem cron job allows for the deletion of unintended files6.2 Medium
- opensuse leap 15.1, texlive-filesystem, suse linux enterprise module for desktop applications 15-sp1 +2 more +4 morerace condition in the packaging of texlive-filesysten4.9 Medium
- apport project apport, canonical ubuntu linux +1 moreApport race condition in crash report permissions5.6 Medium
- adobe creative cloud desktop application, creative cloud +1 moreCreative Cloud Desktop Application versions 5.0 and earlier have a time-of-check to time-of-use ...5.9 Medium
- google androidAn issue was discovered on Samsung mobile devices with N(7.X) and O(8.X) (Exynos 7570, 7870, 7880...8.1 High
- parallels desktopThis vulnerability allows local attackers to escalate privileges on affected installations of...8.2 High
- yarnpkg yarnTOCTOU Race Condition in Yarn5.9 Medium
- opensmtpd, canonical ubuntu linux, fedoraproject fedora +2 moreOpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux...4.7 Medium
- misp-project mispAn issue was discovered in MISP before 2.4.121. It mishandled time skew (between the machine...5.9 Medium
- apple ipados, iphone os, mac os x +6 more +8 moreAn issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted...3.1 Low
- bitdefender box 2, box 2 firmware +1 moreBitdefender BOX v2 bootstrap update_setup command execution vulnerability (VA-2226)8.3 High
- google androidIn onCreate of InstallStart.java, there is a possible package validation bypass due to a time-of...6.7 Medium
- bullguard premium protectionThe malware scan function in BullGuard Premium Protection 20.0.371.8 has a TOCTOU issue that...5.9 Medium
- cyxtera appgate sdpIn Cyxtera AppGate SDP Client 4.1.x through 4.3.x before 4.3.2 on Windows, a local or remote user...8.8 High
- Show moreLoading…