Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2022-2590—A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only sharEPSS 0.9%CVE-2013-1278HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 0.9%CVE-2024-23651HIGHBuildKit possible race condition with accessing subpaths from cache mountsEPSS 0.9%CVE-2026-20927MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 0.9%CVE-2023-28232HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 0.9%CVE-2022-42864HIGHA race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, maEPSS 0.9%CVE-2013-1292HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 GEPSS 0.9%CVE-2020-3163MEDIUMCisco Unified Contact Center Enterprise Denial of Service VulnerabilityEPSS 0.9%CVE-2024-26578MEDIUMApache Answer: Repeated submission at registration created duplicate users with the same nameEPSS 0.9%CVE-2023-49619LOWApache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.EPSS 0.9%CVE-2025-47997MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 0.9%CVE-2025-60723MEDIUMDirectX Graphics Kernel Denial of Service VulnerabilityEPSS 0.9%CVE-2026-33827HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-35255MEDIUMAzure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-49744HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-0397HIGHMemory race condition in ssl.SSLContext certificate store methodsEPSS 0.8%CVE-2025-59200HIGHData Sharing Service Spoofing VulnerabilityEPSS 0.8%CVE-2024-24860MEDIUMRace condition vulnerability in Linux kernel bluetooth driver in {min,max}_key_size_set()EPSS 0.8%CVE-2025-32421LOWNext.js Race Condition to Cache PoisoningEPSS 0.8%CVE-2026-20919HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.8%