Weaknesses of type CWE-362

1,086 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.5%CVE-2015-8963HIGHRace condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (usEPSS 1.4%CVE-2022-24800HIGHRace Condition in October CMS upload processEPSS 1.4%CVE-2024-49124HIGHLightweight Directory Access Protocol (LDAP) Client Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-5947HIGHSIG(0) validation during query flood may lead to undefined behaviorEPSS 1.4%CVE-2018-17244—Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active DirEPSS 1.3%CVE-2022-24950—A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorizEPSS 1.3%CVE-2024-2193MEDIUMSpeculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.EPSS 1.3%CVE-2022-34702HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 1.2%CVE-2022-23639HIGHImproper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilsEPSS 1.2%CVE-2026-20921HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2026-27921HIGHWindows TDI Translation Driver (tdx.sys) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2021-24377—Autoptimize < 2.7.8 - Race Condition leading to RCEEPSS 1.2%CVE-2023-28201CRITICALThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iEPSS 1.2%CVE-2023-27359CRITICALTP-Link AX1800 hotplugd Firewall Rule Race Condition VulnerabilityEPSS 1.2%CVE-2024-43467HIGHWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2022-41039HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.1%CVE-2021-3597—A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of serviEPSS 1.1%CVE-2026-32093HIGHWindows Function Discovery Service (fdwsd.dll) Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2025-32710HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.1%