Weaknesses of type CWE-362

1,090 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2024-50135MEDIUMnvme-pci: fix race condition between reset and nvme_dev_disable()EPSS 0.2%CVE-2026-11145MEDIUMRace in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTMEPSS 0.2%CVE-2026-7366MEDIUMIBM DataPower Gateway affected by HTTP request header leakage in XML-FirewallEPSS 0.2%CVE-2025-43364HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26.1. AEPSS 0.2%CVE-2025-20039MEDIUMRace condition for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentEPSS 0.2%CVE-2024-50183MEDIUMscsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instanceEPSS 0.2%CVE-2025-37088MEDIUMA security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, EPSS 0.2%CVE-2021-33075MEDIUMRace condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged EPSS 0.2%CVE-2023-42832HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS VentuEPSS 0.2%CVE-2026-96456MEDIUMReachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated deviceEPSS 0.2%CVE-2025-15546MEDIUMIptanus File Upload < 5.1.7 - File Overwrite via Race ConditionEPSS 0.2%CVE-2023-49603HIGHRace condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabEPSS 0.2%CVE-2024-22386MEDIUMRace condition vulnerability in Linux kernel drm/exynos exynos_drm_crtc_atomic_disableEPSS 0.2%CVE-2023-48366MEDIUMRace condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabEPSS 0.2%CVE-2026-34856HIGHUAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2025-64682LOWIn JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limitEPSS 0.2%CVE-2024-53160MEDIUMrcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcuEPSS 0.2%CVE-2022-24114—Local privilege escalation due to race condition on application startupEPSS 0.2%CVE-2026-27814MEDIUMEVerest EvseManager phase-switch path has unsynchronized shared-state access race conditionEPSS 0.2%CVE-2021-33078MEDIUMRace condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to poteEPSS 0.2%