Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2021-3597—A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of serviEPSS 1.2%CVE-2024-43467HIGHWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-32093HIGHWindows Function Discovery Service (fdwsd.dll) Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2022-3623MEDIUMLinux Kernel BPF gup.c follow_page_pte race conditionEPSS 1.1%CVE-2025-32710HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.1%CVE-2022-24949—A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, bufferEPSS 1.1%CVE-2013-1294HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 1.1%CVE-2018-15687HIGHsystemd: chown_one() can dereference symlinksEPSS 1.1%CVE-2013-1265HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1275HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1253HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2021-20316—A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or moEPSS 1.0%CVE-2023-3758HIGHSssd: race condition during authorization leads to gpo policies functioning inconsistentlyEPSS 1.0%CVE-2020-25668—A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free iEPSS 1.0%CVE-2019-7614—A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system withEPSS 1.0%CVE-2023-21712HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.0%CVE-2020-15706MEDIUMGRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.EPSS 1.0%CVE-2022-24751MEDIUMRace condition in ZulipEPSS 1.0%CVE-2026-94300HIGHConcurrent GSS-TSIG messages corrupt memoryEPSS 1.0%CVE-2021-44731HIGHsnapd could be made to escalate privileges and run programs as administratorEPSS 1.0%