Weaknesses of type CWE-667

151 results

Sincronização inadequada ou ausente

Ocorre quando código que acessa dados compartilhados entre threads não usa mecanismos de lock (mutex, semáforo) ou usa incorretamente, permitindo race conditions. Múltiplas threads podem modificar o mesmo dado simultaneamente, causando corrupção de estado, comportamentos imprevistos ou falhas de segurança.

Example

Um sistema web gerencia um contador de sessões ativas sem sincronização: duas requisições simultâneas leem o valor 100, incrementam para 101 e escrevem ambas o resultado, quando deveria ser 102. Em contexto crítico, como controle de acesso ou limite de recursos, isso pode ser explorado.

How to mitigate

Use primitivas de sincronização adequadas (mutex, ReentrantLock, synchronized) ao acessar dados compartilhados. Minimize seções críticas e prefira estruturas thread-safe quando disponíveis (ConcurrentHashMap, AtomicInteger). Code review e testes com ferramentas de detecção de race conditions.

CVE-2021-1782HIGHA race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, SecurityEPSS 2.2%KEVCVE-2021-20291A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each lEPSS 1.6%CVE-2021-41141MEDIUMMissing release of locks in PJSIPEPSS 1.4%CVE-2021-3667An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath fEPSS 1.4%CVE-2022-3996HIGHX.509 Policy Constraints Double LockingEPSS 1.2%CVE-2022-0897A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex bEPSS 1.0%CVE-2002-0051HIGHWindows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read acEPSS 0.8%CVE-2022-48216HIGHUniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.EPSS 0.8%CVE-2023-3750MEDIUMLibvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of serviceEPSS 0.8%CVE-2022-22175HIGHJunos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processedEPSS 0.7%CVE-2024-58087CRITICALksmbd: fix racy issue from session lookup and expireEPSS 0.5%CVE-2023-22412HIGHJunos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if the SIP ALG is enabled and specific SIP messages are processedEPSS 0.5%CVE-2022-32811HIGHA memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, SecEPSS 0.5%CVE-2019-14898HIGHThe fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive EPSS 0.4%CVE-2024-32648MEDIUMvyper default functions don't respect nonreentrancy keysEPSS 0.4%CVE-2021-4149A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. InEPSS 0.4%CVE-2026-20065MEDIUMMultiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityEPSS 0.4%CVE-2022-2959A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within thEPSS 0.4%CVE-2025-43510HIGHA memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 andEPSS 0.4%KEVCVE-2019-3901MEDIUMA race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particulaEPSS 0.3%