Fallos del tipo CWE-367

674 resultados

Condição de corrida entre verificação e uso (TOCTOU)

Ocorre quando o código verifica uma condição (ex: permissão de arquivo, saldo bancário) e depois usa o recurso, mas entre a verificação e o uso algo muda. Um atacante explora essa janela de tempo para alterar o estado, burlar a validação e executar operações não autorizadas.

Ejemplo

Um processo verifica se tem permissão de leitura em um arquivo, mas antes de ler, um outro processo muda o arquivo de lugar ou altera suas permissões. O primeiro processo tenta ler o que acredita ser o arquivo autorizado, mas na verdade acessa outro recurso.

Cómo mitigar

Use operações atômicas que combinam verificação e acesso em um único passo (ex: abrir arquivo com flags específicas). Em transações, implemente locks ou mecanismos de sincronização para evitar mudanças entre a validação e execução da ação.

CVE-2026-37531CRITICALAGL app-framework-main thru 17.1.12 contains a Zip Slip path traversal vulnerability (CWE-22) combined with a TOCTOU race condition (CWE-367EPSS 0.7%CVE-2022-23181—Local privilege escalation with FileStoreEPSS 0.7%CVE-2026-55950HIGHDTLS listener crash via race condition in dtls_packet_demux causes denial of service for all sessionsEPSS 0.7%CVE-2019-11774—Prior to 0.1, all builds of Eclipse OMR contain a bug where the loop versioner may fail to privatize a value that is pulled out of the loop EPSS 0.7%CVE-2023-38041HIGHA logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. When a particular process flEPSS 0.7%CVE-2024-30471MEDIUMApache StreamPipes: Potential creation of multiple identical accountsEPSS 0.7%CVE-2022-26387HIGHWhen installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underEPSS 0.7%CVE-2022-22753HIGHA Time-of-Check Time-of-Use bug existed in the Maintenance (Updater) Service that could be abused to grant Users write access to an arbitrarEPSS 0.6%CVE-2023-38141HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-49730HIGHMicrosoft Windows QoS Scheduler Driver Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-3464HIGHA race condition vulnerability exists in Armoury Crate. This vulnerability arises from a Time-of-check Time-of-use issue, potentially leadinEPSS 0.6%CVE-2024-27297MEDIUMNix Corruption of fixed-output derivationsEPSS 0.6%CVE-2022-34830HIGHAn Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operatiEPSS 0.6%CVE-2024-30099HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-27114HIGHRemote Code Execution through File Upload in SOPlanning before 1.52.02EPSS 0.5%CVE-2023-0778MEDIUMA Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume wiEPSS 0.5%CVE-2023-21537HIGHMicrosoft Message Queuing (MSMQ) Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-19118HIGHRace condition vulnerability was identified in GitHub Enterprise Server that allowed remote code executionEPSS 0.5%CVE-2024-38153HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-56648HIGHWindows NFS Server Elevation of Privilege VulnerabilityEPSS 0.5%