Weaknesses of type CWE-362

1,090 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2026-48982MEDIUMpam_usb: Missing O_EXCL on pad temp file creation allows concurrent update raceEPSS 0.1%CVE-2026-64717MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6EPSS 0.1%CVE-2026-23558HIGHgrant table v2 race in status page mappingEPSS 0.1%CVE-2026-10681MEDIUMSMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slotEPSS 0.1%CVE-2026-43781MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.1%CVE-2026-43770MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.EPSS 0.1%CVE-2025-39927HIGHceph: fix race condition validating r_parent before applying stateEPSS 0.1%CVE-2025-25278HIGHliteos_a has a race condition vulnerabilityEPSS 0.1%CVE-2023-52720MEDIUMRace condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2025-68957HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.1%CVE-2026-43659MEDIUMA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.1%CVE-2025-68958HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.1%CVE-2026-43811MEDIUMA race condition was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6. An appEPSS 0.1%CVE-2026-84550MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7EPSS 0.1%CVE-2026-43755HIGHA race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be aEPSS 0.1%CVE-2026-13502LOWantlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctouEPSS 0.1%CVE-2026-28992MEDIUMA memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPaEPSS 0.1%CVE-2026-65401MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be abEPSS 0.1%CVE-2026-84630MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoEPSS 0.1%CVE-2026-65360MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoEPSS 0.1%