Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2019-18567MEDIUMBromium client - out of bound read results in race condition causing Kernel memory leaks or denial of serviceEPSS 0.5%CVE-2026-64720CRITICALA race condition was addressed with improved state handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, wEPSS 0.5%CVE-2022-48366LOWAn issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.EPSS 0.5%CVE-2022-36422MEDIUMWP-PostRatings plugin <= 1.89 - Rating increase/decrease via race conditionEPSS 0.5%CVE-2024-21601MEDIUMJunos OS: SRX Series: Due to an error in processing TCP events flowd will crashEPSS 0.5%CVE-2025-43531LOWA race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and EPSS 0.5%CVE-2022-44551CRITICALThe iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integriEPSS 0.4%CVE-2024-32985MEDIUMStellar-core's Overlay - security fix for DDoS mitigationEPSS 0.4%CVE-2022-40310MEDIUMWordPress Rate my Post – WP Rating System plugin <= 3.3.4 - Race Condition vulnerabilityEPSS 0.4%CVE-2026-17712HIGHRace in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftEPSS 0.4%CVE-2024-27267MEDIUMIBM SDK, Java Technology Edition denial of serviceEPSS 0.4%CVE-2023-47634LOWDecidim has race condition in EndorsementsEPSS 0.4%CVE-2024-29863HIGHA race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may EPSS 0.4%CVE-2024-36615MEDIUMFFmpeg n7.0 has a race condition vulnerability in the VP9 decoder. This could lead to a data race if video encoding parameters were being exEPSS 0.4%CVE-2024-49084HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-35554HIGHApache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race ConditionEPSS 0.4%CVE-2019-14898HIGHThe fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive EPSS 0.4%CVE-2025-38561CRITICALksmbd: fix Preauh_HashValue race conditionEPSS 0.4%CVE-2021-3609—.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to coEPSS 0.4%CVE-2024-23239MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4, tvOS 17.4, EPSS 0.4%