Fallos del tipo CWE-662

30 resultados

Sincronização inadequada entre threads

Ocorre quando múltiplas threads acessam e modificam dados compartilhados sem mecanismos de sincronização (locks, mutexes, semáforos). Isso causa race conditions, onde o resultado depende da ordem de execução das threads, levando a corrupção de dados, travamentos ou comportamento imprevisível.

Ejemplo

Um contador de usuários simultâneos em uma aplicação web: duas requisições leem o valor 100, ambas incrementam para 101 e escrevem de volta. O resultado deveria ser 102, mas é apenas 101. Se esse contador controla limites críticos, o sistema fica vulnerável.

Cómo mitigar

Use primitivas de sincronização nativa da linguagem (synchronized em Java, locks em Python, mutexes em C), ferramentas de detecção estática (thread sanitizers), e testes com alto grau de concorrência. Para dados compartilhados críticos, considere estruturas thread-safe ou design que evite compartilhamento direto.

CVE-2024-7409HIGHQemu: denial of service via improper synchronization in qemu nbd server during socket closureEPSS 1.0%CVE-2024-32644CRITICALEvmos' transaction execution not accounting for all state transition after interaction with precompilesEPSS 0.9%CVE-2026-39865MEDIUMAxios HTTP/2 Session Cleanup State Corruption VulnerabilityEPSS 0.7%CVE-2026-72057HIGHnet/sched: act_ct: preserve tc_skb_cb across defragmentationEPSS 0.6%CVE-2025-68775CRITICALnet/handshake: duplicate handshake cancellations leak socketEPSS 0.5%CVE-2026-64312HIGHcrypto: pcrypt - restore callback for non-parallel fallbackEPSS 0.5%CVE-2026-28789HIGHOliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handlingEPSS 0.5%CVE-2025-27104LOWdouble eval in For List Iter in VyperEPSS 0.4%CVE-2026-43466HIGHnet/mlx5e: Fix DMA FIFO desync on error CQE SQ recoveryEPSS 0.4%CVE-2026-13489LOW78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronizationEPSS 0.3%CVE-2026-43362HIGHsmb: client: fix in-place encryption corruption in SMB2_write()EPSS 0.3%CVE-2026-63832HIGHwifi: mt76: add wcid publish check in mt76_sta_addEPSS 0.2%CVE-2026-68404HIGHwifi: cfg80211: use wiphy work for socket owner autodisconnectEPSS 0.2%CVE-2026-64556HIGHperf/core: Detach event groups during remove_on_execEPSS 0.2%CVE-2022-32643MEDIUMIn ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.2%CVE-2025-22853LOWImproper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege viaEPSS 0.2%CVE-2026-68103HIGHdrm/amdgpu: reject mapping a reserved doorbell to a new queueEPSS 0.2%CVE-2022-32609MEDIUMIn vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2022-32610MEDIUMIn vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2026-68149HIGHfs: preserve ACL_DONT_CACHE state in forget_cached_acl()EPSS 0.1%