Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2025-24240MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 0.2%CVE-2023-30571LOWLibarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changeEPSS 0.2%CVE-2024-36894HIGHusb: gadget: f_fs: Fix race between aio_cancel() and AIO request completeEPSS 0.2%CVE-2022-42806HIGHA race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app may be able toEPSS 0.2%CVE-2022-0207—A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear tEPSS 0.2%CVE-2026-79117MEDIUMRace condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeriEPSS 0.2%CVE-2026-20930HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2023-38409—An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurEPSS 0.2%CVE-2025-59193HIGHWindows Management Services Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2023-3108MEDIUMKernel: a race condition in crypto module in the function skcipher_recvmsgEPSS 0.2%CVE-2022-49344MEDIUMaf_unix: Fix a data-race in unix_dgram_peer_wake_me().EPSS 0.2%CVE-2024-3979MEDIUMCOVESA vsomeip race conditionEPSS 0.2%CVE-2026-87615MEDIUMRace condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elemeEPSS 0.2%CVE-2022-49414MEDIUMext4: fix race condition between ext4_write and ext4_convert_inline_dataEPSS 0.2%CVE-2022-49603MEDIUMip: Fix data-races around sysctl_ip_fwd_update_priority.EPSS 0.2%CVE-2022-49600MEDIUMip: Fix a data-race around sysctl_ip_autobind_reuse.EPSS 0.2%CVE-2022-49594MEDIUMtcp: Fix a data-race around sysctl_tcp_mtu_probe_floor.EPSS 0.2%CVE-2024-53088HIGHi40e: fix race condition by adding filter's intermediate sync stateEPSS 0.2%CVE-2026-55945MEDIUMMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 0.2%CVE-2022-49587MEDIUMtcp: Fix a data-race around sysctl_tcp_notsent_lowat.EPSS 0.2%