A program checks a user's privilege, then performs the requested action later. The privilege can change between the check and action. What is the central problem?

### Why this is right The security decision may become stale because the state can change between checking the privilege and using it. The material identifies non-atomic check-and-use operations as a source of race conditions. ### The concept An operation is atomic when it behaves as an indivisible unit for the relevant security decision. If the check and action are separated, an intervening change may make the action unauthorized or produce corrupted output. ### The other options - **A buffer overflow because the user entered too much data**: this concerns memory bounds, not timing between a check and use. - **Sniffing because traffic is being observed**: sniffing is network eavesdropping. - **A denial-of-service attack because the service is unavailable**: this concerns service availability. ### Terms - **Race condition**: a timing-dependent flaw. - **Atomic**: treated as indivisible in the relevant operation. ### Remember If a security state can change between checking and acting, suspect a race condition.