Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2013-1292HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 GEPSS 0.9%CVE-2022-2590—A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only sharEPSS 0.9%CVE-2020-3163MEDIUMCisco Unified Contact Center Enterprise Denial of Service VulnerabilityEPSS 0.9%CVE-2024-26578MEDIUMApache Answer: Repeated submission at registration created duplicate users with the same nameEPSS 0.9%CVE-2023-49619LOWApache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.EPSS 0.9%CVE-2022-42864HIGHA race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, maEPSS 0.9%CVE-2022-3623MEDIUMLinux Kernel BPF gup.c follow_page_pte race conditionEPSS 0.8%CVE-2026-33827HIGHWindows TCP/IP Remote Code Execution VulnerabilityEPSS 0.8%CVE-2024-35255MEDIUMAzure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-47997MEDIUMMicrosoft SQL Server Information Disclosure VulnerabilityEPSS 0.8%CVE-2026-20919HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-20926HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2024-0397HIGHMemory race condition in ssl.SSLContext certificate store methodsEPSS 0.8%CVE-2025-59200HIGHData Sharing Service Spoofing VulnerabilityEPSS 0.8%CVE-2024-24860MEDIUMRace condition vulnerability in Linux kernel bluetooth driver in {min,max}_key_size_set()EPSS 0.8%CVE-2025-60723MEDIUMDirectX Graphics Kernel Denial of Service VulnerabilityEPSS 0.8%CVE-2024-23651HIGHBuildKit possible race condition with accessing subpaths from cache mountsEPSS 0.8%CVE-2025-39964HIGHcrypto: af_alg - Disallow concurrent writes in af_alg_sendmsgEPSS 0.8%KEVCVE-2020-1660HIGHJunos OS: MX Series: Receipt of specific packets can cause services card to restart when DNS filtering is configured.EPSS 0.8%CVE-2021-36532HIGHRace condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhostEPSS 0.8%