The potential vulnerability that occurs when there is a change between when an app checks a resource and when the app uses the resource is known as?

The potential vulnerability that occurs when there is a change between when an app checks a resource and when the app uses the resource is known as?

• A. Time-of-check to time-of-use (TOCTOU)
• B. TOCTOU
• C. Race condition
• D. Synchronization issue

Answer: (B)

The vulnerability being tested is a timing flaw where the resource is checked for a condition and then, before it is used, the resource changes. This creates a window an attacker can exploit to alter the outcome or gain something unintended. The precise name for this is TOCTOU—Time-of-check to time-of-use. It captures the idea that verification happens at one moment but the actual usage happens later, allowing the state to drift in between. TOCTOU is a specific kind of race condition: the exact result depends on the unpredictable timing between checking a condition and acting on it. It’s more precise than a general synchronization issue, which is about coordinating concurrent tasks in a broader sense but doesn’t pin down the check-then-use gap. In practice, defending against TOCTOU involves making the check and the use atomic, re-checking just before use, or using atomic OS primitives and proper locking or file operations that cannot be disrupted between verification and use.

The vulnerability being tested is a timing flaw where the resource is checked for a condition and then, before it is used, the resource changes. This creates a window an attacker can exploit to alter the outcome or gain something unintended. The precise name for this is TOCTOU—Time-of-check to time-of-use. It captures the idea that verification happens at one moment but the actual usage happens later, allowing the state to drift in between.

TOCTOU is a specific kind of race condition: the exact result depends on the unpredictable timing between checking a condition and acting on it. It’s more precise than a general synchronization issue, which is about coordinating concurrent tasks in a broader sense but doesn’t pin down the check-then-use gap. In practice, defending against TOCTOU involves making the check and the use atomic, re-checking just before use, or using atomic OS primitives and proper locking or file operations that cannot be disrupted between verification and use.