Fallos del tipo CWE-362

1090 resultados

Condição de corrida (Race Condition)

Ocorre quando múltiplas threads ou processos acessam e modificam um recurso compartilhado (arquivo, variável, banco de dados) sem sincronização adequada. O resultado final depende da ordem de execução, que é imprevisível, permitindo que um atacante manipule o timing para causar comportamento não autorizado ou corrupção de dados.

Ejemplo

Um aplicativo web verifica se um usuário tem saldo antes de debitar uma transação, mas não mantém lock entre a verificação e o débito. Um atacante dispara dois saques simultâneos da mesma conta; ambos passam na validação antes que qualquer um tenha atualizado o saldo, resultando em saque maior que o disponível.

Cómo mitigar

Use mecanismos de sincronização (mutex, semáforos, locks) ao acessar recursos compartilhados, ou implemente operações atômicas que garantam que verificação e modificação ocorram como uma única unidade indivisível. Em bases de dados, use transações com isolamento adequado (SERIALIZABLE quando necessário).

CVE-2026-56988MEDIUMIn multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation oEPSS 0.1%CVE-2025-54629MEDIUMRace condition issue occurring in the physical page import process of the memory management module. Impact: Successful exploitation of this EPSS 0.1%CVE-2025-48641HIGHIn multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilegeEPSS 0.1%CVE-2025-54651MEDIUMRace condition vulnerability in the kernel hufs module. Impact: Successful exploitation of this vulnerability may affect service confidentiaEPSS 0.1%CVE-2023-20685MEDIUMIn vdec, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2023-20684MEDIUMIn vdec, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2026-58734HIGHIn google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalEPSS 0.1%CVE-2026-58728HIGHIn ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege withEPSS 0.1%CVE-2023-20687MEDIUMIn display drm, there is a possible double free due to a race condition. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2025-68969MEDIUMMulti-thread race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affectEPSS 0.1%CVE-2026-58724HIGHIn multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with SysEPSS 0.1%CVE-2023-20686MEDIUMIn display drm, there is a possible double free due to a race condition. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2026-58701HIGHIn trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalatEPSS 0.1%CVE-2025-66328HIGHMulti-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affectEPSS 0.1%CVE-2022-47331MEDIUMIn wlan driver, there is a race condition. This could lead to local denial of service in wlan services.EPSS 0.1%CVE-2026-34849LOWUAF vulnerability in the screen management module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2025-22442HIGHIn multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created EPSS 0.1%CVE-2023-20835MEDIUMIn camsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2025-66327HIGHRace condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentialityEPSS 0.1%CVE-2023-20736MEDIUMIn vcu, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System executEPSS 0.1%