Fallos del tipo CWE-367
680 resultadosCondição de corrida entre verificação e uso (TOCTOU)
Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.
Ejemplo
Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.
Cómo mitigar
Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.
CVE-2026-5958LOWRace Condition in GNU SedEPSS 0.1%CVE-2026-53799HIGHrsync < 3.5.0 Symlink Race Condition via ACL/xattr ApplicationEPSS 0.1%CVE-2026-82430HIGHApache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the TenantEPSS 0.1%CVE-2026-1880MEDIUMAn Incorrect Permission Assignment for Critical Resource vulnerability in the ASUS DriverHub update process allows privilege escalation due EPSS 0.1%CVE-2022-27539HIGHPotential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allEPSS 0.1%CVE-2022-31635HIGHPotential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allEPSS 0.1%CVE-2022-27541HIGHPotential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allEPSS 0.1%CVE-2022-31637HIGHPotential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allEPSS 0.1%CVE-2022-43777HIGHPotential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allEPSS 0.1%CVE-2022-31642HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.1%CVE-2026-34452MEDIUMClaude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox EscapeEPSS 0.1%CVE-2022-31636HIGHPotential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allEPSS 0.1%CVE-2022-31638HIGHPotential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allEPSS 0.1%CVE-2024-39821MEDIUMZoom Workplace App for Windows and Zoom Rooms App for Windows - Race ConditionEPSS 0.1%CVE-2022-31639HIGHPotential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allEPSS 0.1%CVE-2022-30283HIGHIn UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTEPSS 0.1%CVE-2022-27538HIGHA potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow aEPSS 0.1%CVE-2026-24191HIGHNVIDIA Display Driver for Windows contains a vulnerability where an attacker could cause a time-of-check time-of-use issue. A successful expEPSS 0.1%CVE-2022-34325HIGHDMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruptioEPSS 0.1%CVE-2021-46795MEDIUMA TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memoryEPSS 0.1%