Weaknesses of type CWE-362

1,081 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2013-1294HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 1.1%CVE-2022-27626CRITICALA vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessioEPSS 1.1%CVE-2018-15687HIGHsystemd: chown_one() can dereference symlinksEPSS 1.1%CVE-2013-1253HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1265HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1275HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2022-39328CRITICALGrafana vulnerable to race condition allowing privilege escalationEPSS 1.0%CVE-2023-3758HIGHSssd: race condition during authorization leads to gpo policies functioning inconsistentlyEPSS 1.0%CVE-2025-25214HIGHA race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. EPSS 1.0%CVE-2022-24949—A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, bufferEPSS 1.0%CVE-2020-25668—A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free iEPSS 1.0%CVE-2019-7614—A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system withEPSS 1.0%CVE-2023-21712HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.0%CVE-2021-20316—A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or moEPSS 1.0%CVE-2020-15706MEDIUMGRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.EPSS 1.0%CVE-2022-24751MEDIUMRace condition in ZulipEPSS 1.0%CVE-2021-44731HIGHsnapd could be made to escalate privileges and run programs as administratorEPSS 1.0%CVE-2013-1278HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 0.9%CVE-2026-20927MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 0.9%CVE-2023-28232HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 0.9%