Weaknesses of type CWE-667

154 results

Sincronização inadequada ou ausente

Ocorre quando código que acessa dados compartilhados entre threads não usa mecanismos de lock (mutex, semáforo) ou usa incorretamente, permitindo race conditions. Múltiplas threads podem modificar o mesmo dado simultaneamente, causando corrupção de estado, comportamentos imprevistos ou falhas de segurança.

Example

Um sistema web gerencia um contador de sessões ativas sem sincronização: duas requisições simultâneas leem o valor 100, incrementam para 101 e escrevem ambas o resultado, quando deveria ser 102. Em contexto crítico, como controle de acesso ou limite de recursos, isso pode ser explorado.

How to mitigate

Use primitivas de sincronização adequadas (mutex, ReentrantLock, synchronized) ao acessar dados compartilhados. Minimize seções críticas e prefira estruturas thread-safe quando disponíveis (ConcurrentHashMap, AtomicInteger). Code review e testes com ferramentas de detecção de race conditions.

CVE-2025-39910MEDIUMmm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()EPSS 0.1%CVE-2025-39915MEDIUMnet: phy: transfer phy_config_inband() locking responsibility to phylinkEPSS 0.1%CVE-2023-20619MEDIUMIn vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2023-20618MEDIUMIn vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2023-21000HIGHIn MediaCodec.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no addiEPSS 0.1%CVE-2026-42489MEDIUMdomctl lock open to abuseEPSS 0.1%CVE-2023-20746MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20737MEDIUMIn vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2023-20745MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20743MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20733MEDIUMIn vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2023-20939HIGHIn multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead toEPSS 0.1%CVE-2026-20757LOWImproper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service iEPSS 0.1%CVE-2026-56914HIGHIn multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no EPSS 0.1%