Patent ID: 7657936

Claim:
A method of preventing time of check to time of use exploits, the method comprising: receiving a system call from a user space at a system call intercept; copying user space parameters from the user space to a kernel space responsive to the system call; initiating a service thread within the kernel space, wherein the service thread is operable to create a secure location in the user space and pass an offset indicative of a location of the secure location to the system call interrupt; copying the user space parameters from the kernel space to the secure location in the user space, wherein the service thread that creates and manages the secure location is contained in a trusted daemon; receiving the user space parameters from the secure location at the system call intercept, wherein receiving the user space parameters from the secure location comprises receiving at least one pointer directed to the secure location; determining whether the secure location is mapped to the system call; and mapping the secure location into an address space of a process making the system call based on the determination; executing the system call based on the received user space parameters; and notifying the service thread based on execution of the system call, wherein the secure location is closed to all requests after the user space parameters are copied to the secure location and until the service thread is notified of system call execution.