Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2024-24858MEDIUMRace condition vulnerability in Linux kernel net/bluetooth in {conn,adv}_{min,max}_interval_set()EPSS 0.3%CVE-2025-1013MEDIUMPotential opening of private browsing tabs in normal browsing windowsEPSS 0.3%CVE-2026-71537MEDIUMPaymenter: Credit-refund double-spend race condition in service downgrade (doUpgrade)EPSS 0.3%CVE-2025-49665HIGHWorkspace Broker Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-53150HIGHWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-53768HIGHXbox IStorageService Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2020-25653—A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unpriviEPSS 0.3%CVE-2026-78934HIGHRace condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitEPSS 0.3%CVE-2026-105163MEDIUMcrossplane crossplane-runtime ImageConfig client.go Get toctouEPSS 0.3%CVE-2026-89099HIGHRace Condition in MongoDB Server Document Value Layer Leads to Memory CorruptionEPSS 0.3%CVE-2026-43215HIGHcifs: Fix locking usage for tcon fieldsEPSS 0.3%CVE-2024-7598LOWNetwork restriction bypass via race condition during namespace terminationEPSS 0.3%CVE-2022-3567MEDIUMLinux Kernel IPv6 inet6_dgram_ops race conditionEPSS 0.3%CVE-2020-16123MEDIUMBypass of snapd pulseaudio restrictionsEPSS 0.3%CVE-2025-61560HIGHA race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass raEPSS 0.3%CVE-2026-20844HIGHWindows Clipboard Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-65415HIGHA race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visioEPSS 0.3%CVE-2024-24857MEDIUMRace condition vulnerability in Linux kernel bluetooth in conn_info_{min,max}_age_set()EPSS 0.3%CVE-2026-52945HIGHRevert "wireguard: device: enable threaded NAPI"EPSS 0.3%CVE-2025-71183CRITICALbtrfs: always detect conflicting inodes when logging inode refsEPSS 0.3%