Weaknesses of type CWE-362

1,089 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2024-6778HIGHRace in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injecEPSS 0.8%CVE-2022-2854HIGHUse after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via EPSS 0.8%CVE-2025-32421LOWNext.js Race Condition to Cache PoisoningEPSS 0.8%CVE-2022-2857HIGHUse after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.8%CVE-2024-54494MEDIUMA race condition was addressed with additional validation. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.EPSS 0.8%CVE-2020-3353MEDIUMCisco Identity Services Engine Denial of Service VulnerabilityEPSS 0.8%CVE-2011-1075—FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new vEPSS 0.8%CVE-2021-20251—A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if speEPSS 0.8%CVE-2022-32895MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to modify protectedEPSS 0.8%CVE-2026-20848HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2026-20934HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2025-30444CRITICALA race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. EPSS 0.8%CVE-2022-22737HIGHConstructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-aftEPSS 0.8%CVE-2025-5054MEDIUMRace Condition in Canonical ApportEPSS 0.7%CVE-2023-32570MEDIUMVideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.EPSS 0.7%CVE-2025-49744HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-42099HIGHRace Condition in Sparx Pro Cloud ServerEPSS 0.7%CVE-2021-0270HIGHJunos OS: PTX Series, QFX10K Series: A PTX/QFX FPC may restart unexpectedly with the "inline-Jflow" feature enabled on a large-scale deploymentEPSS 0.7%CVE-2024-24859MEDIUMRace condition vulnerability in Linux kernel bluetooth sniff_{min,max}_interval_set()EPSS 0.7%CVE-2023-33974HIGHRIOT-OS vulnerable to Race Condition in SFR TimeoutEPSS 0.7%