Lion Cipher Lab
Win a TOCTOU symlink race, then defend against it
- Cyber / Security Engineer
- Advanced
- ~75 min
- Free · no account required
Why it matters
TOCTOU (Time-Of-Check-to-Time-Of-Use) is one of the oldest and most stubborn bug classes in privileged software: a program checks that a path is safe, then acts on that same path a moment later, and an attacker changes what the path points to in the gap. It has produced real local-privilege-escalation CVEs in installers, backup agents, container runtimes, package managers, and setuid tools for decades, and it keeps recurring because the naive fix ('check the path again, more carefully') is itself racy. Feeling the race win on your own machine — watching a success counter climb, then watching…
What you'll learn
- TOCTOU race conditions (CWE-367)
- Symlink-following attacks (CWE-363)
- Secure file handling in C (open/openat2/fstat)
- O_NOFOLLOW and RESOLVE_NO_SYMLINKS / RESOLVE_BENEATH
- Reasoning about atomicity and the check-vs-use gap
Steps in this lab
- The one idea: 'check' and 'use' are two moments, not one
- Set up a scratch lab (no root, self-contained)
- Build the vulnerable helper (lstat, then open — CWE-367)
- Build the attacker (an atomic symlink swap with RENAME_EXCHANGE)
- Wire up the spool, the secret, and the swap pair
- Build the measurement harness
- Win the race and measure it
- Read the result: widening the window, and how a pro wins at delay 0
- Defense 1: open first with O_NOFOLLOW, then fstat the descriptor
- Re-run the attacker against Defense 1 — watch it hit zero
- Defense 2: openat2 with RESOLVE_NO_SYMLINKS / RESOLVE_BENEATH
- Re-run against Defense 2 — zero, and it covers more ground
- The access() trap: why the naive privileged version is doubly broken
- Name the failure modes (and when NOT to worry)