Fallos del tipo CWE-362

1089 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2024-56441MEDIUMRace condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-64168HIGHAgno session state overwrites between different sessions/usersEPSS 0.1%CVE-2024-36285MEDIUMRace condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an authenticatedEPSS 0.1%CVE-2026-11253MEDIUMInappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via EPSS 0.1%CVE-2024-54120MEDIUMRace condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause featuresEPSS 0.1%CVE-2026-26070MEDIUMEVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point CrashEPSS 0.1%CVE-2023-42974HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 anEPSS 0.1%CVE-2026-11677HIGHRace in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to potentiEPSS 0.1%CVE-2024-36262HIGHRace condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabEPSS 0.1%CVE-2024-26942MEDIUMnet: phy: qcom: at803x: fix kernel panic with at8031_probeEPSS 0.1%CVE-2026-12454HIGHRace in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to EPSS 0.1%CVE-2025-21984HIGHmm: fix kernel BUG when userfaultfd_move encounters swapcacheEPSS 0.1%CVE-2026-78915HIGHRace condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitEPSS 0.1%CVE-2026-12468HIGHRace in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.1%CVE-2022-49920HIGHnetfilter: nf_tables: netlink notifier might race to release objectsEPSS 0.1%CVE-2023-45864MEDIUMA race condition issue discovered in Samsung Mobile Processor Exynos 9820, 980, 1080, 2100, 2200, 1280, and 1380 allows unintended modificatEPSS 0.1%CVE-2026-48066MEDIUMpam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authenticationEPSS 0.1%CVE-2026-18151MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.EPSS 0.1%CVE-2026-62294MEDIUMFlameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"EPSS 0.1%CVE-2023-53020MEDIUMl2tp: close all race conditions in l2tp_tunnel_register()EPSS 0.1%