Skip to main content

Time-of-check Time-of-use (TOCTOU) Race Condition

CVE-2024-56337

High
9.2/10

Summary

Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. Users running Tomcat on a case insensitive file system with the default servlet write enabled (readonly initialisation parameter set to the non-default value of false) may need additional configuration to fully mitigate CVE-2024-50379 depending on which version of Java they are using with Tomcat: - running on Java 8 or Java 11: the system property `sun.io.useCanonCaches` must be explicitly set to false (it defaults to true) - running on Java 17: the system property `sun.io.useCanonCaches`, if set, must be set to false (it defaults to false) - running on Java 21 onwards: no further configuration is required (the system property and the problematic cache have been removed) Tomcat 11.0.3, 10.1.35 and 9.0.99 onwards will include checks that `sun.io.useCanonCaches` is set appropriately before allowing the default servlet to be write enabled on a case insensitive file system. Tomcat will also set `sun.io.useCanonCaches` to false by default where it can. This issue affects org.apache.tomcat:tomcat-catalina 9.0.0.M1 through 9.0.97, 10.1.0-M1 through 10.1.33, and 11.0.0-M1 through 11.0.1.

  • LOW
  • NETWORK
  • NONE
  • NONE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.

References

Advisory Timeline

  • Published