Fallos del tipo CWE-362

1088 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2013-1294HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 1.1%CVE-2022-27626CRITICALA vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessioEPSS 1.1%CVE-2018-15687HIGHsystemd: chown_one() can dereference symlinksEPSS 1.1%CVE-2013-1253HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1265HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1275HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2022-39328CRITICALGrafana vulnerable to race condition allowing privilege escalationEPSS 1.0%CVE-2023-3758HIGHSssd: race condition during authorization leads to gpo policies functioning inconsistentlyEPSS 1.0%CVE-2025-25214HIGHA race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. EPSS 1.0%CVE-2022-24949—A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, bufferEPSS 1.0%CVE-2020-25668—A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free iEPSS 1.0%CVE-2019-7614—A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system withEPSS 1.0%CVE-2023-21712HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.0%CVE-2021-20316—A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or moEPSS 1.0%CVE-2020-15706MEDIUMGRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.EPSS 1.0%CVE-2022-24751MEDIUMRace condition in ZulipEPSS 1.0%CVE-2021-44731HIGHsnapd could be made to escalate privileges and run programs as administratorEPSS 1.0%CVE-2013-1278HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 0.9%CVE-2026-20927MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 0.9%CVE-2023-28232HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 0.9%