Fallos del tipo CWE-362

1433 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2026-17979HIGHRace in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pEPSS 0.3%CVE-2026-32887HIGHEffect Bug: `AsyncLocalStorage` context lost/contaminated inside Effect fibers under concurrent load with RPCEPSS 0.3%CVE-2025-54108HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-53807HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-54114HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-24951—A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enEPSS 0.3%CVE-2026-7432HIGHA race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMEPSS 0.3%CVE-2026-113282HIGHRace condition in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer processEPSS 0.3%CVE-2025-32441MEDIUMRack session gets restored after deletionEPSS 0.3%CVE-2023-52553HIGHRace condition vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2025-66803MEDIUMRace condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when delayed frame responsEPSS 0.3%CVE-2026-8741LOWEMQX QoS 2 PUBLISH Packet emqx_persistent_session_ds.erl race conditionEPSS 0.3%CVE-2025-49690HIGHCapability Access Management Service (camsvc) Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-26779HIGHwifi: mac80211: fix race condition on enabling fast-xmitEPSS 0.3%CVE-2026-53358HIGHBluetooth: L2CAP: use chan timer to close channels in cleanup_listen()EPSS 0.3%CVE-2026-113016HIGHRace condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass systeEPSS 0.3%CVE-2026-113150HIGHRace condition in Bindings in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially bypass site isolation via a crafEPSS 0.3%CVE-2025-8880HIGHRace in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML EPSS 0.3%CVE-2020-27825—A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and EPSS 0.3%CVE-2026-23230HIGHsmb: client: split cached_fid bitfields to avoid shared-byte RMW racesEPSS 0.3%