Sciweavers

Share
FAST
2008

Portably Solving File TOCTTOU Races with Hardness Amplification

11 years 10 months ago
Portably Solving File TOCTTOU Races with Hardness Amplification
The file-system API of contemporary systems makes programs vulnerable to TOCTTOU (time of check to time of use) race conditions. Existing solutions either help users to detect these problems (by pinpointing their locations in the code), or prevent the problem altogether (by modifying the kernel or its API). The latter alternative is not prevalent, and the former is just the first step: programmers must still address TOCTTOU flaws within the limits of the existing API with which several important tasks can not be accomplished in a portable straightforward manner. Recently, Dean and Hu addressed this problem and suggested a probabilistic hardness amplification approach that alleviated the matter. Alas, shortly after, Borisov et al. responded with an attack termed "filesystem maze" that defeated the new approach. We begin by noting that mazes constitute a generic way to deterministically win many TOCTTOU races (gone are the days when the probability was small). In the face of t...
Dan Tsafrir, Tomer Hertz, David Wagner, Dilma Da S
Added 02 Oct 2010
Updated 02 Oct 2010
Type Conference
Year 2008
Where FAST
Authors Dan Tsafrir, Tomer Hertz, David Wagner, Dilma Da Silva
Comments (0)
books