Fallos del tipo CWE-667

151 resultados

Sincronização inadequada de acesso a recursos compartilhados

Ocorre quando código que acessa dados ou recursos compartilhados (variáveis globais, arquivos, conexões de banco) não usa mecanismos adequados de sincronização (locks, mutexes, semáforos). Isso permite que múltiplas threads ou processos modifiquem o mesmo recurso simultaneamente, causando corrupção de dados, valores inconsistentes ou comportamento impredizível.

Ejemplo

Uma aplicação multi-thread que incrementa um contador sem lock: duas threads podem ler o valor 100 ao mesmo tempo, incrementar para 101, e ambas escreverem 101 — perdendo uma unidade de incremento. Ou pior: um banco de dados que aceita duas conexões simultâneas atualizando o mesmo saldo, resultando em estados inconsistentes.

Cómo mitigar

Use mutex/lock ao acessar dados compartilhados; prefira estruturas thread-safe da linguagem (ConcurrentHashMap em Java, locks em Python); minimize o escopo e duração de seções críticas; valide e teste cenários de concorrência com ferramentas de análise estática.

CVE-2021-1782HIGHA race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, SecurityEPSS 2.2%KEVCVE-2021-20291—A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each lEPSS 1.6%CVE-2021-41141MEDIUMMissing release of locks in PJSIPEPSS 1.4%CVE-2021-3667—An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath fEPSS 1.4%CVE-2022-3996HIGHX.509 Policy Constraints Double LockingEPSS 1.2%CVE-2022-0897—A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex bEPSS 1.0%CVE-2002-0051HIGHWindows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read acEPSS 0.8%CVE-2022-48216HIGHUniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.EPSS 0.8%CVE-2023-3750MEDIUMLibvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of serviceEPSS 0.8%CVE-2022-22175HIGHJunos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processedEPSS 0.7%CVE-2024-58087CRITICALksmbd: fix racy issue from session lookup and expireEPSS 0.5%CVE-2023-22412HIGHJunos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if the SIP ALG is enabled and specific SIP messages are processedEPSS 0.5%CVE-2022-32811HIGHA memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, SecEPSS 0.5%CVE-2019-14898HIGHThe fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive EPSS 0.4%CVE-2024-32648MEDIUMvyper default functions don't respect nonreentrancy keysEPSS 0.4%CVE-2021-4149—A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. InEPSS 0.4%CVE-2026-20065MEDIUMMultiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityEPSS 0.4%CVE-2022-2959—A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within thEPSS 0.4%CVE-2025-43510HIGHA memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 andEPSS 0.4%KEVCVE-2019-3901MEDIUMA race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particulaEPSS 0.3%