Weaknesses of type CWE-362

1,090 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2023-53310MEDIUMpower: supply: axp288_fuel_gauge: Fix external_power_changed raceEPSS 0.1%CVE-2026-84630MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoEPSS 0.1%CVE-2026-65401MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be abEPSS 0.1%CVE-2026-61079MEDIUMVulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 2EPSS 0.1%CVE-2025-39905HIGHnet: phylink: add lock for serializing concurrent pl->phydev writes with resolverEPSS 0.1%CVE-2025-64345LOWWasmtime provides unsound API access to a WebAssembly shared linear memoryEPSS 0.1%CVE-2022-50379MEDIUMbtrfs: fix race between quota enable and quota rescan ioctlEPSS 0.1%CVE-2026-41964HIGHPermission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-43690MEDIUMA race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A lEPSS 0.1%CVE-2026-43743MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, EPSS 0.1%CVE-2025-68956HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.1%CVE-2025-68955HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avEPSS 0.1%CVE-2026-20617HIGHA race condition was addressed with improved state handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS SoEPSS 0.1%CVE-2026-28830MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive uEPSS 0.1%CVE-2025-27577HIGHliteos_a has a race condition vulnerabilityEPSS 0.1%CVE-2022-50339HIGHBluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()EPSS 0.1%CVE-2026-58088HIGHRace condition in ELF core dump segment countingEPSS 0.1%CVE-2025-21101MEDIUMDell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit tEPSS 0.1%CVE-2025-48548HIGHIn multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the privacy indicator due to EPSS 0.1%CVE-2023-31225LOWThe Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect prodEPSS 0.1%