...
Comparing i-nodes using the st_ino fields and devices using the st_dev fields ensures that the file passed to lstat() is the same as the file passed to fstat() (see FIO05-A. Identify files using multiple file attributes).
Automatic Detection
The tool Compass / ROSE does not currently detect TOCTOU race conditions; however it can be easily extended to do so. One must search for a call to open() or fopen(), and then get the filename argument. Also get the file descriptor which is the return value. If the filename is a variable AND the variable is referenced earlier in a function like stat() or lstat() AND the file descriptor is assigned to a variable, but the variable is never the argument to a subsequent fstat() function call, then this rule is violated.
Risk Assessment
Time-of-creation-to-time-of-use (TOCTOU) race condition vulnerabilities can be exploited to gain elevated privileges.
...