Defense and Attack Techniques against File-based TOCTOU Vulnerabilities: a Systematic Review

Raducu, R. (Universidad de Zaragoza) ; Rodríguez Fernández, R. J. (Universidad de Zaragoza) ; Álvarez Pérez-Aradros, P. (Universidad de Zaragoza)

Resumen: File-based Time-of-Check to Time-of-Use (TOCTOU) race conditions are a well-known type of security vulnerability. A wide variety of techniques have been proposed to detect, mitigate, avoid, and exploit these vulnerabilities over the past 35 years. However, despite these research efforts, TOCTOU vulnerabilities remain unsolved due to their non-deterministic nature and the particularities of the different filesystems involved in running vulnerable programs, especially in Unix-like operating system environments. In this paper, we present a systematic literature review on defense and attack techniques related to the file-based TOCTOU vulnerability. We apply a reproducible methodology to search, filter, and analyze the most relevant research proposals to define a global and understandable vision of existing solutions. The results of this analysis are finally used to discuss future research directions that can be explored to move towards a universal solution to this type of vulnerability. Author

Idioma: Inglés

DOI: 10.1109/ACCESS.2022.3153064

Año: 2022

Publicado en: IEEE Access 10 (2022), 21742-21758
ISSN: 2169-3536

Factor impacto JCR: 3.9 (2022)

Categ. JCR: COMPUTER SCIENCE, INFORMATION SYSTEMS rank: 73 / 158 = 0.462 (2022) - Q2 - T2
Categ. JCR: TELECOMMUNICATIONS rank: 41 / 88 = 0.466 (2022) - Q2 - T2
Categ. JCR: ENGINEERING, ELECTRICAL & ELECTRONIC rank: 100 / 274 = 0.365 (2022) - Q2 - T2

Factor impacto CITESCORE: 9.0 - Engineering (Q1) - Computer Science (Q1) - Materials Science (Q1)

Factor impacto SCIMAGO: 0.926 - Computer Science (miscellaneous) (Q1) - Materials Science (miscellaneous) (Q1) - Engineering (miscellaneous) (Q1)

Financiación: info:eu-repo/grantAgreement/ES/DGA-UZ/T21-20R
Financiación: info:eu-repo/grantAgreement/ES/MINECO/PDC2021-121072-C22

Tipo y forma: Artículo (Versión definitiva)

Área (Departamento): Área Lenguajes y Sistemas Inf. (Dpto. Informát.Ingenie.Sistms.)