Weaknesses of type CWE-362

1,090 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2023-53368MEDIUMtracing: Fix race issue between cpu buffer write and swapEPSS 0.1%CVE-2023-1582MEDIUMA race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attaEPSS 0.1%CVE-2023-28142MEDIUMRace ConditionEPSS 0.1%CVE-2026-7351LOWRace in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to install a malicious extension to leak croEPSS 0.1%CVE-2024-43701HIGHGPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devicesEPSS 0.1%CVE-2026-43783HIGHA race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privEPSS 0.1%CVE-2026-3006HIGHRace Condition VulnerabilityEPSS 0.1%CVE-2026-47270MEDIUMpam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote resultEPSS 0.1%CVE-2026-35099HIGHLakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions areEPSS 0.1%CVE-2026-27189MEDIUMOpenSift: Race-prone local persistence could cause state corruption/lossEPSS 0.1%CVE-2026-22701MEDIUMfilelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockEPSS 0.1%CVE-2026-13198MEDIUMConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControlEPSS 0.1%CVE-2026-54778MEDIUMCoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity ResolutionEPSS 0.1%CVE-2025-33235HIGHNVIDIA Resiliency Extension for Linux contains a vulnerability in the checkpointing core, where an attacker may cause a race condition. A suEPSS 0.1%CVE-2025-30513HIGHRace condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privilegEPSS 0.1%CVE-2025-52993MEDIUMA race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the builEPSS 0.1%CVE-2024-52906MEDIUMIBM AIX denial of serviceEPSS 0.1%CVE-2026-60161MEDIUMVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.EPSS 0.1%CVE-2026-28834MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 2EPSS 0.1%CVE-2026-13197HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControlEPSS 0.1%