Weaknesses of type CWE-362

1,433 results

Condição de corrida

Ocorre quando dois ou mais processos/threads acessam e modificam um recurso compartilhado simultaneamente, sem sincronização adequada. O resultado final depende da ordem e timing das operações, criando estados inconsistentes que podem ser explorados para contornar controles de segurança, corromper dados ou ganhar privilégios.

Example

Um aplicativo verifica se um arquivo existe e tem permissão de leitura (check), depois o abre (use). Um atacante, entre o check e o use, substitui o arquivo por um link simbólico apontando para /etc/passwd. O programa abre inadvertidamente um arquivo sensível que não deveria acessar.

How to mitigate

Use primitivas de sincronização (mutexes, semáforos, locks) para serializar acessos críticos. Quando possível, use operações atômicas do SO (ex: open com flags O_EXCL) que combinam check e use em uma única syscall indivisível. Validar estado antes de cada operação crítica, não apenas uma vez.

CVE-2021-0270HIGHJunos OS: PTX Series, QFX10K Series: A PTX/QFX FPC may restart unexpectedly with the "inline-Jflow" feature enabled on a large-scale deploymentEPSS 0.7%CVE-2022-2160MEDIUMInsufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to iEPSS 0.7%CVE-2024-24859MEDIUMRace condition vulnerability in Linux kernel bluetooth sniff_{min,max}_interval_set()EPSS 0.7%CVE-2023-33974HIGHRIOT-OS vulnerable to Race Condition in SFR TimeoutEPSS 0.7%CVE-2026-45742HIGHGotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')EPSS 0.7%CVE-2026-50369HIGHWindows Remote Desktop Services Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-56649MEDIUMWindows Network File System Remote Code Execution VulnerabilityEPSS 0.7%CVE-2020-1667HIGHJunos OS: MX Series: Services card might restart due to a race condition when DNS filtering is enabled.EPSS 0.7%CVE-2025-50169HIGHWindows SMB Remote Code Execution VulnerabilityEPSS 0.7%CVE-2023-0739HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answerEPSS 0.7%CVE-2024-27823MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS MEPSS 0.7%CVE-2018-3759—private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sockEPSS 0.7%CVE-2021-21005HIGHRace Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series productsEPSS 0.7%CVE-2026-97032HIGHHTTP/2 server crash due to HPACK encoder race in net/httpEPSS 0.7%CVE-2016-20015HIGHIn the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any EPSS 0.7%CVE-2021-31364MEDIUMJunos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedEPSS 0.7%CVE-2022-3049HIGHUse after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user toEPSS 0.7%CVE-2022-4037MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versioEPSS 0.7%CVE-2026-70091MEDIUMWindows DNS Denial of Service VulnerabilityEPSS 0.7%CVE-2025-47972HIGHWindows Input Method Editor (IME) Elevation of Privilege VulnerabilityEPSS 0.7%