Weaknesses of type CWE-667

182 results

Sincronização inadequada ou ausente

Ocorre quando código que acessa dados compartilhados entre threads não usa mecanismos de lock (mutex, semáforo) ou usa incorretamente, permitindo race conditions. Múltiplas threads podem modificar o mesmo dado simultaneamente, causando corrupção de estado, comportamentos imprevistos ou falhas de segurança.

Example

Um sistema web gerencia um contador de sessões ativas sem sincronização: duas requisições simultâneas leem o valor 100, incrementam para 101 e escrevem ambas o resultado, quando deveria ser 102. Em contexto crítico, como controle de acesso ou limite de recursos, isso pode ser explorado.

How to mitigate

Use primitivas de sincronização adequadas (mutex, ReentrantLock, synchronized) ao acessar dados compartilhados. Minimize seções críticas e prefira estruturas thread-safe quando disponíveis (ConcurrentHashMap, AtomicInteger). Code review e testes com ferramentas de detecção de race conditions.

CVE-2025-39832MEDIUMnet/mlx5: Fix lockdep assertion on sync reset unload eventEPSS 0.1%CVE-2026-118052MEDIUMModule Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operationEPSS 0.1%CVE-2025-39884MEDIUMbtrfs: fix subvolume deletion lockup caused by inodes xarray raceEPSS 0.1%CVE-2026-43211HIGHPCI: Fix pci_slot_trylock() error handlingEPSS 0.1%CVE-2025-20044MEDIUMImproper locking for some Intel(R) TDX Module firmware before version 1.5.13 may allow a privileged user to potentially enable escalation ofEPSS 0.1%CVE-2026-112907LOWfilelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale breakEPSS 0.1%CVE-2026-46107HIGHdm-thin: fix metadata refcount underflowEPSS 0.1%CVE-2025-39915MEDIUMnet: phy: transfer phy_config_inband() locking responsibility to phylinkEPSS 0.1%CVE-2026-47581MEDIUMNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper locking. A successful EPSS 0.1%CVE-2026-56914HIGHIn multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no EPSS 0.1%CVE-2023-20619MEDIUMIn vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2023-20618MEDIUMIn vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2023-21000HIGHIn MediaCodec.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no addiEPSS 0.1%CVE-2026-42489MEDIUMdomctl lock open to abuseEPSS 0.1%CVE-2026-20757LOWImproper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service iEPSS 0.1%CVE-2023-20733MEDIUMIn vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2023-20746MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20745MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20743MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20737MEDIUMIn vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution pEPSS 0.1%