CAPEC-29

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. The adversary explores to gauge what level of access they have.

2. Experiment

   They probe what they found.

   2. The adversary confirms access to a resource on the target host. The adversary confirms ability to modify the targeted resource.

3. Exploit

   They carry out the attack.

   3. The adversary decides to leverage the race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary can replace the resource and cause an escalation of privilege.

Prerequisites

• A resource is access/modified concurrently by multiple processes.

• The adversary is able to modify resource.

• A race condition exists while accessing a resource.

Skills required

• Medium skill

  This attack can get sophisticated since the attack has to occur within a short interval of time.

Consequences

Mitigations

• Use safe libraries to access resources such as files.

• Be aware that improper use of access function calls such as chown(), tempfile(), chmod(), etc. can cause a race condition.

• Use synchronization to control the flow of execution.

• Use static analysis tools to find race conditions.

• Pay attention to concurrency problems related to the access of resources.

Weaknesses it exploits

• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
• CWE-366 Race Condition within a Thread
• CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
• CWE-368 Context Switching Race Condition
• CWE-370 Missing Check for Certificate Revocation after Initial Check
• CWE-662 Improper Synchronization
• CWE-663 Use of a Non-reentrant Function in a Concurrent Context
• CWE-665 Improper Initialization
• CWE-691 Insufficient Control Flow Management

Recent CVEs with these weaknesses

1. 6.8CVE-2026-1238042026-11-09

   SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login meth…

2. 5.4CVE-2026-1145942026-11-09

   A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execu…

3. 4.8CVE-2026-1246222026-11-09

   A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgradi…

4. 6.0CVE-2026-926062026-11-09

   Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pard…

5. 3.7CVE-2026-1231282026-11-09

   The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items …

6. 7.4CVE-2026-173372026-11-07

   IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authentication due to improper certificate validation. A certificate check is not performed reliably in all cases, which could allow a connecti…

7. 5.9CVE-2026-634402026-11-06

   2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::…

8. 5.9CVE-2026-1238352026-11-06

   In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-26 Leveraging Race Conditions

More specific patterns

• CAPEC-27 Leveraging Race Conditions via Symbolic Links

Examples

include<sys/types.h>
include<fcntl.h>
include<unistd.h>

define FILE "/tmp/myfile"
define UID 100

void test(char *str)
{
  int fd;
  fd = creat(FILE, 0644);
  if(fd == -1)
    return;

  chown(FILE, UID, -1); /* BAD */
  close(fd);

}

int main(int argc, char **argv)
{
  char *userstr;
  if(argc>1) {
    userstr = argv[1];
    test(userstr);

  }
  return 0;

}

MITRE's words, unchanged: CAPEC-29 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.