Weaknesses of type CWE-667

154 results

Sincronização inadequada ou ausente

Ocorre quando código que acessa dados compartilhados entre threads não usa mecanismos de lock (mutex, semáforo) ou usa incorretamente, permitindo race conditions. Múltiplas threads podem modificar o mesmo dado simultaneamente, causando corrupção de estado, comportamentos imprevistos ou falhas de segurança.

Example

Um sistema web gerencia um contador de sessões ativas sem sincronização: duas requisições simultâneas leem o valor 100, incrementam para 101 e escrevem ambas o resultado, quando deveria ser 102. Em contexto crítico, como controle de acesso ou limite de recursos, isso pode ser explorado.

How to mitigate

Use primitivas de sincronização adequadas (mutex, ReentrantLock, synchronized) ao acessar dados compartilhados. Minimize seções críticas e prefira estruturas thread-safe quando disponíveis (ConcurrentHashMap, AtomicInteger). Code review e testes com ferramentas de detecção de race conditions.

CVE-2019-3901MEDIUMA race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particulaEPSS 0.3%CVE-2021-47242HIGHmptcp: fix soft lookup in subflow_error_report()EPSS 0.3%CVE-2026-21914HIGHJunos OS: SRX Series: A specifically malformed GTP message will cause an FPC crashEPSS 0.3%CVE-2023-44119—Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2025-21809HIGHrxrpc, afs: Fix peer hash locking vs RCU callbackEPSS 0.3%CVE-2021-43395MEDIUMAn issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 20EPSS 0.3%CVE-2022-3303MEDIUMA race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference whiEPSS 0.3%CVE-2005-3106MEDIUMRace condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), might allow local users EPSS 0.3%CVE-2023-2612MEDIUMshiftfs lock unbalance in Ubuntu-specific kernelsEPSS 0.3%CVE-2024-45818MEDIUMDeadlock in x86 HVM standard VGA handlingEPSS 0.3%CVE-2009-2857MEDIUMThe kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtEPSS 0.3%CVE-2026-54906LOWconcurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionEPSS 0.3%CVE-2021-41213MEDIUMDeadlock in mutually recursive `tf.function` objectsEPSS 0.2%CVE-2021-4147—A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock EPSS 0.2%CVE-2025-49178MEDIUMXorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignoreEPSS 0.2%CVE-2022-49441MEDIUMtty: fix deadlock caused by calling printk() under tty_port->lockEPSS 0.2%CVE-2025-58153HIGHBIG-IP HSB vulnerabilityEPSS 0.2%CVE-2021-22530HIGHImproper account management vulnerability in NetIQ Advance AuthenticationEPSS 0.2%CVE-2022-42328MEDIUMGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vEPSS 0.2%CVE-2024-56531HIGHALSA: caiaq: Use snd_card_free_when_closed() at disconnectionEPSS 0.2%