Fallos del tipo CWE-362

1090 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2026-11812LOWUpdateHub: race condition on shared context causes out-of-bounds write and DoSEPSS 0.1%CVE-2026-14367LOWI3C IBI work-node free-list data race between ISR and workqueue threadEPSS 0.1%CVE-2025-46284HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to EPSS 0.1%CVE-2026-17654HIGHRace in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicEPSS 0.1%CVE-2022-32613MEDIUMIn vcu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2022-32612MEDIUMIn vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2026-46732MEDIUMDell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain a Concurrent Execution using Shared Resource with Improper SyEPSS 0.1%CVE-2026-46693MEDIUMImageMagick: Race Condition in distributed pixel cache server can result in file descriptor hijackingEPSS 0.1%CVE-2025-24493MEDIUMkernel_liteos_a has a race condition vulnerabilityEPSS 0.1%CVE-2024-47968MEDIUMImproper resource shutdown in middle of certain operations on some Solidigm DC Products may allow an attacker to potentially enable denial oEPSS 0.1%CVE-2026-87467HIGHRace condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary coEPSS 0.1%CVE-2022-32621MEDIUMIn isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2025-20119MEDIUMCisco Application Policy Infrastructure Controller Authenticated Local Denial of Service VulnerabilityEPSS 0.1%CVE-2022-26758HIGHA malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improvEPSS 0.1%CVE-2026-84562MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able to access protected uEPSS 0.1%CVE-2024-0041HIGHIn removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This cEPSS 0.1%CVE-2025-36934HIGHIn bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could EPSS 0.1%CVE-2026-22702MEDIUMvirtualenv Has TOCTOU Vulnerabilities in Directory CreationEPSS 0.1%CVE-2025-48564HIGHIn multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege wiEPSS 0.1%CVE-2026-58093HIGHKernel use-after-free via tty ioctlsEPSS 0.1%