Fallos del tipo CWE-362

1433 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2026-45712MEDIUMMailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal error: concurrent map read and map write)EPSS 0.3%CVE-2022-34696HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2024-24255MEDIUMA Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send dEPSS 0.3%CVE-2022-45885HIGHAn issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-aEPSS 0.3%CVE-2026-5120HIGHRace Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026EPSS 0.3%CVE-2026-113052HIGHRace condition in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandEPSS 0.3%CVE-2026-44318MEDIUMfree5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on SubscriptionsEPSS 0.3%CVE-2026-26201HIGHemp3r0r Affected by Concurrent Map Access DoS (panic/crash)EPSS 0.3%CVE-2026-64435HIGHaudit: Fix data races of skb_queue_len() readers on audit_queueEPSS 0.3%CVE-2020-10684HIGHA flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_faEPSS 0.3%CVE-2026-22856MEDIUMFreeRDP has a heap-use-after-free in create_irp_threadEPSS 0.3%CVE-2026-54497MEDIUMview_component: Reused Component Instances Retain Stale Render ContextEPSS 0.3%CVE-2025-33254HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this EPSS 0.3%CVE-2025-33238HIGHNVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploitEPSS 0.3%CVE-2026-31539HIGHsmb: smbdirect: introduce smbdirect_socket.recv_io.credits.availableEPSS 0.3%CVE-2025-48000HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-3608MEDIUMRace condition in nsHttpTransaction could lead to memory corruptionEPSS 0.3%CVE-2025-1801HIGHAap-gateway: aap-gateway privilege escalationEPSS 0.3%CVE-2025-55228HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-1013MEDIUMPotential opening of private browsing tabs in normal browsing windowsEPSS 0.3%