Weaknesses of type CWE-667

154 results

Sincronização inadequada ou ausente

Ocorre quando código que acessa dados compartilhados entre threads não usa mecanismos de lock (mutex, semáforo) ou usa incorretamente, permitindo race conditions. Múltiplas threads podem modificar o mesmo dado simultaneamente, causando corrupção de estado, comportamentos imprevistos ou falhas de segurança.

Example

Um sistema web gerencia um contador de sessões ativas sem sincronização: duas requisições simultâneas leem o valor 100, incrementam para 101 e escrevem ambas o resultado, quando deveria ser 102. Em contexto crítico, como controle de acesso ou limite de recursos, isso pode ser explorado.

How to mitigate

Use primitivas de sincronização adequadas (mutex, ReentrantLock, synchronized) ao acessar dados compartilhados. Minimize seções críticas e prefira estruturas thread-safe quando disponíveis (ConcurrentHashMap, AtomicInteger). Code review e testes com ferramentas de detecção de race conditions.

CVE-2026-62426HIGHsysctl and platform-op locks open to abuseEPSS 0.2%CVE-2022-42329MEDIUMGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vEPSS 0.2%CVE-2025-10151HIGHMalicious TCP/IP thread locking leads into diverse malfunctionsEPSS 0.2%CVE-2025-34467MEDIUMZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative PagesEPSS 0.2%CVE-2025-14345LOWCross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB ServerEPSS 0.2%CVE-2022-49322MEDIUMtracing: Fix sleeping function called from invalid context on RT kernelEPSS 0.2%CVE-2024-56532MEDIUMALSA: us122l: Use snd_card_free_when_closed() at disconnectionEPSS 0.2%CVE-2022-49371MEDIUMdriver core: fix deadlock in __device_attachEPSS 0.2%CVE-2022-49316MEDIUMNFSv4: Don't hold the layoutget locks across multiple RPC callsEPSS 0.2%CVE-2022-3028—A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_alEPSS 0.2%CVE-2022-49313MEDIUMdrivers: usb: host: Fix deadlock in oxu_bus_suspend()EPSS 0.2%CVE-2024-56533MEDIUMALSA: usx2y: Use snd_card_free_when_closed() at disconnectionEPSS 0.2%CVE-2024-50229MEDIUMnilfs2: fix potential deadlock with newly created symlinksEPSS 0.2%CVE-2022-49315MEDIUMdrivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()EPSS 0.2%CVE-2021-3735—A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-dEPSS 0.2%CVE-2022-49305MEDIUMdrivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop()EPSS 0.2%CVE-2022-49304MEDIUMdrivers: tty: serial: Fix deadlock in sa1100_set_termios()EPSS 0.2%CVE-2022-49446MEDIUMnvdimm: Fix firmware activation deadlock scenariosEPSS 0.2%CVE-2023-52932MEDIUMmm/swapfile: add cond_resched() in get_swap_pages()EPSS 0.2%CVE-2026-42490MEDIUMdomctl lock open to abuseEPSS 0.2%