Weaknesses of type CWE-667

154 results

Sincronização inadequada ou ausente

Ocorre quando código que acessa dados compartilhados entre threads não usa mecanismos de lock (mutex, semáforo) ou usa incorretamente, permitindo race conditions. Múltiplas threads podem modificar o mesmo dado simultaneamente, causando corrupção de estado, comportamentos imprevistos ou falhas de segurança.

Example

Um sistema web gerencia um contador de sessões ativas sem sincronização: duas requisições simultâneas leem o valor 100, incrementam para 101 e escrevem ambas o resultado, quando deveria ser 102. Em contexto crítico, como controle de acesso ou limite de recursos, isso pode ser explorado.

How to mitigate

Use primitivas de sincronização adequadas (mutex, ReentrantLock, synchronized) ao acessar dados compartilhados. Minimize seções críticas e prefira estruturas thread-safe quando disponíveis (ConcurrentHashMap, AtomicInteger). Code review e testes com ferramentas de detecção de race conditions.

CVE-2021-0147MEDIUMImproper locking in the Power Management Controller (PMC) for some Intel Chipset firmware before versions pmc_fw_lbg_c1-21ww02a and pmc_fw_lEPSS 0.2%CVE-2024-58088MEDIUMbpf: Fix deadlock when freeing cgroup storageEPSS 0.2%CVE-2024-54683MEDIUMnetfilter: IDLETIMER: Fix for possible ABBA deadlockEPSS 0.2%CVE-2024-56687MEDIUMusb: musb: Fix hardware lockup on first Rx endpoint requestEPSS 0.2%CVE-2022-49850MEDIUMnilfs2: fix deadlock in nilfs_count_free_blocks()EPSS 0.2%CVE-2025-68657MEDIUMespressif/usb_host_hid Double-Free Race Condition in USB Host HID Device Close PathEPSS 0.2%CVE-2025-20047MEDIUMImproper locking in the Intel(R) Integrated Connectivity I/O interface (CNVi) for some Intel(R) Core™ Ultra Processors may allow an unauthenEPSS 0.2%CVE-2025-21951MEDIUMbus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlockEPSS 0.2%CVE-2025-21908MEDIUMNFS: fix nfs_release_folio() to not deadlock via kcompactd writebackEPSS 0.2%CVE-2025-48618MEDIUMIn processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. TEPSS 0.2%CVE-2025-21911MEDIUMdrm/imagination: avoid deadlock on fence releaseEPSS 0.2%CVE-2023-53348MEDIUMbtrfs: fix deadlock when aborting transaction during relocation with scrubEPSS 0.2%CVE-2023-53013MEDIUMptdma: pt_core_execute_cmd() should use spinlockEPSS 0.2%CVE-2022-50371MEDIUMled: qcom-lpg: Fix sleeping in atomicEPSS 0.1%CVE-2025-23134MEDIUMALSA: timer: Don't take register_mutex with copy_from/to_user()EPSS 0.1%CVE-2023-53016MEDIUMBluetooth: Fix possible deadlock in rfcomm_sk_state_changeEPSS 0.1%CVE-2024-53086MEDIUMdrm/xe: Drop VM dma-resv lock on xe_sync_in_fence_get failure in exec IOCTLEPSS 0.1%CVE-2024-50207HIGHring-buffer: Fix reader locking when changing the sub buffer orderEPSS 0.1%CVE-2024-48875MEDIUMbtrfs: don't take dev_replace rwsem on task already holding itEPSS 0.1%CVE-2023-53022MEDIUMnet: enetc: avoid deadlock in enetc_tx_onestep_tstamp()EPSS 0.1%