Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2022-49578MEDIUMip: Fix data-races around sysctl_ip_prot_sock.EPSS 0.2%CVE-2024-57913MEDIUMusb: gadget: f_fs: Remove WARN_ON in functionfs_bindEPSS 0.2%CVE-2022-49580MEDIUMipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.EPSS 0.2%CVE-2025-49737HIGHMicrosoft Teams Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-76393MEDIUMRace Condition during Model Upload through the REST API in Splunk AI ToolkitEPSS 0.2%CVE-2026-9959LOWRace in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.2%CVE-2026-7954LOWRace in Shared Storage in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak crEPSS 0.2%CVE-2025-21688MEDIUMdrm/v3d: Assign job pointer to NULL before signaling the fenceEPSS 0.2%CVE-2026-87641MEDIUMRace condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a craftEPSS 0.2%CVE-2024-24855MEDIUMRace condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()EPSS 0.2%CVE-2022-42832MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privEPSS 0.2%CVE-2022-49634MEDIUMsysctl: Fix data-races in proc_dou8vec_minmax().EPSS 0.2%CVE-2022-42831MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privEPSS 0.2%CVE-2026-25184HIGHApplocker Filter Driver (applockerfltr.sys) Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2021-46925HIGHnet/smc: fix kernel panic caused by race of smc_sockEPSS 0.2%CVE-2025-10216LOWGrandNode Voucher ConfirmOrder race conditionEPSS 0.2%CVE-2022-49443MEDIUMlist: fix a data-race around ep->rdllistEPSS 0.2%CVE-2024-24864MEDIUMRace condition vulnerability in Linux kernel media/dvb-core in dvbdmx_write()EPSS 0.2%CVE-2024-33904HIGHIn plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arbEPSS 0.2%CVE-2022-49588MEDIUMtcp: Fix data-races around sysctl_tcp_migrate_req.EPSS 0.2%