A Methodical Defense against TOCTTOU Attacks: The EDGI Approach

TOCTTOU is a challenging and significant problem, involving two-step (check and use) file object access by a victim process and simultaneously an attacker access to the same file object in-between the two steps. We describe a model-based, event-driven defense mechanism (called EDGI), which prevents such attacks by stopping the second process in-between the two steps. Our main contribution is the systematic design and implementation of EDGI defense and its evaluation. EDGI has no false negatives and very few false positives. It works without changing application code or API. A Linux kernel implementation shows the practicality of the EDGI defense, and an experimental evaluation shows low additional overhead on representative workloads.