A privileged program checks whether the calling user may write to a file path and, a moment later, opens that path to write. Between those two steps, an attacker replaces the file with a symbolic link to a protected system file. Which vulnerability is being exploited?
Select an answer to reveal the explanation.
Short Explanation
It's like a bouncer checking your ID, turning his head, and you hand your wristband to someone else before you walk in. The check was fine, the use was not -- and the gap between them is the vulnerability. That's TOCTOU, and the word "between" in the question is your giveaway.
Full Explanation
A race condition occurs when the outcome of an operation depends on the timing of events that the program does not control. The time-of-check to time-of-use variant arises when software validates a condition, such as permission to write to a path, and then acts on the resource later, assuming the condition still holds. If an attacker changes the resource in that interval, for example by swapping a file for a symbolic link that points to a protected file, the privileged program performs the action on a target the user was never allowed to modify. A buffer overflow writes more data into memory than a buffer can hold, corrupting adjacent memory; the scenario involves no oversized input. Directory traversal uses sequences such as dot-dot segments in a path to escape an intended directory, while here the path was valid when checked and the object behind it changed afterward. A memory leak is a failure to release memory, which can exhaust resources but does not redirect a write to a different file. Exam caveat: the defining clue is a check and a use separated in time with a change in between. Operational check: ensure the code opens the file first and then validates the opened handle, uses atomic operations, and refuses to follow symbolic links in privileged write paths.