Time-of-check To Time-of-use (TOCTOU)

2022-02-1109:38:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

time-of-check time-of-use vulnerability

tempfile

software

EPSS

Percentile

5.1%

JSON

tensorflow is vulnerable to time-of-check to time-of-use vulnerability. The use of tempfile.mktemp allows different process to create the file between the check for the filename in mktemp and the actual creation of the file by a subsequent operation.

References

github.com/tensorflow/tensorflow/blob/87462bfac761435a46641ff2f10ad0b6e5414a4b/tensorflow/compiler/mlir/tensorflow/tests/tf_saved_model/common_v1.py#L85

github.com/tensorflow/tensorflow/blob/c35fbff6d5748d8d0da415992d2199d878d04f6d/tensorflow/security/advisory/tfsa-2022-027.md

github.com/tensorflow/tensorflow/security/advisories/GHSA-wc4g-r73w-x8mm