A name is not the thing it points to. A file path, a link or an alias can resolve to one object today and another a moment later. CWE-386 describes the weakness: a constant symbolic reference to an object is used, even though the reference can resolve to a different object over time.
It shows up wherever code checks a name and later uses it, especially in file systems with symbolic links, where another user or process can change the target in between.
How it happens
The program resolves a name, decides it is safe, then acts on the name again instead of on the object it checked. Between those steps an attacker swaps what the name points to. This is why MITRE ties the consequence to race conditions.
if (access("/var/app/out.log", W_OK) == 0) {
fd = open("/var/app/out.log", O_WRONLY); // name resolved a second time
}
If out.log becomes a symbolic link to a protected file between the two calls, the open lands on the wrong object.
What an attacker gains
MITRE lists several consequences:
- Access control: gain privileges or assume identity, reaching otherwise unauthorized resources.
- Integrity and confidentiality: read or write resources the user normally could not, through a race.
- Integrity: the resource, or others reached through it, can be changed in undesirable ways.
- Non-repudiation: if a file is written this way, logging of the activity may not occur, and in some cases files such as logs may be deleted.
How to find it
The record lists no detection methods. Look for check-then-use sequences on paths, and for any code that follows links in directories others can write to.
How to fix it
The record carries no mitigations, so these are general principles consistent with the weakness:
- Resolve once and hold the handle. Operate on the open file descriptor, not on the name.
- Open without following links where the platform allows it.
- Keep working files in directories that only your account can modify.
Quick check
Why does checking a path and then opening it fail?
Because the path is resolved twice. The second resolution can land somewhere different from the first.
