Fallos del tipo CWE-362

1433 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2022-42791HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrarEPSS 0.3%CVE-2026-24040MEDIUMjsPDF has a Shared State Race Condition in addJS PluginEPSS 0.3%CVE-2026-23230HIGHsmb: client: split cached_fid bitfields to avoid shared-byte RMW racesEPSS 0.3%CVE-2026-23440HIGHnet/mlx5e: Fix race condition during IPSec ESN updateEPSS 0.3%CVE-2024-50297HIGHnet: xilinx: axienet: Enqueue Tx packets in dql before dmaengine startsEPSS 0.3%CVE-2026-59324HIGHfluxTransform shared RequestMessageHolder causes cross-message header leakage under async fluxFunctionEPSS 0.3%CVE-2026-18150MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for iEPSS 0.3%CVE-2025-48751LOWThe process_lock crate 0.1.0 for Rust allows data races in unlock.EPSS 0.3%CVE-2022-1247—An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many EPSS 0.3%CVE-2026-104855LOWWasmtime: Preemption and traps during bulk operations enable breaking internal VM stateEPSS 0.3%CVE-2026-17709CRITICALRace in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.3%CVE-2026-17855CRITICALRace in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.3%CVE-2024-50313MEDIUMA vulnerability has been identified in Mendix Runtime V10 (All versions < V10.16.0 only if the basic authentication mechanism is used by theEPSS 0.3%CVE-2026-17711CRITICALRace in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenEPSS 0.3%CVE-2025-49762HIGHWindows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-50350CRITICALscsi: target: iscsi: Fix a race condition between login_work and the login threadEPSS 0.3%CVE-2023-37904LOWDiscourse Race Condition in Accept InviteEPSS 0.3%CVE-2026-63867HIGHmptcp: close TOCTOU race while computing rcv_wndEPSS 0.3%CVE-2023-42756MEDIUMKernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swapEPSS 0.3%CVE-2026-121628MEDIUMBagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage AccountingEPSS 0.3%