Fallos del tipo CWE-667

182 resultados

Sincronização inadequada de acesso a recursos compartilhados

Ocorre quando código que acessa dados ou recursos compartilhados (variáveis globais, arquivos, conexões de banco) não usa mecanismos adequados de sincronização (locks, mutexes, semáforos). Isso permite que múltiplas threads ou processos modifiquem o mesmo recurso simultaneamente, causando corrupção de dados, valores inconsistentes ou comportamento impredizível.

Ejemplo

Uma aplicação multi-thread que incrementa um contador sem lock: duas threads podem ler o valor 100 ao mesmo tempo, incrementar para 101, e ambas escreverem 101 — perdendo uma unidade de incremento. Ou pior: um banco de dados que aceita duas conexões simultâneas atualizando o mesmo saldo, resultando em estados inconsistentes.

Cómo mitigar

Use mutex/lock ao acessar dados compartilhados; prefira estruturas thread-safe da linguagem (ConcurrentHashMap em Java, locks em Python); minimize o escopo e duração de seções críticas; valide e teste cenários de concorrência com ferramentas de análise estática.

CVE-2021-1782HIGHA race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, SecurityEPSS 2.2%KEVCVE-2021-20291—A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each lEPSS 1.6%CVE-2021-41141MEDIUMMissing release of locks in PJSIPEPSS 1.4%CVE-2021-3667—An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath fEPSS 1.4%CVE-2022-3996HIGHX.509 Policy Constraints Double LockingEPSS 1.3%CVE-2022-0897—A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex bEPSS 1.0%CVE-2022-48216HIGHUniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.EPSS 0.8%CVE-2002-0051HIGHWindows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files with exclusive-read acEPSS 0.8%CVE-2023-3750MEDIUMLibvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of serviceEPSS 0.8%CVE-2022-22175HIGHJunos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processedEPSS 0.7%CVE-2024-58087CRITICALksmbd: fix racy issue from session lookup and expireEPSS 0.5%CVE-2023-22412HIGHJunos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if the SIP ALG is enabled and specific SIP messages are processedEPSS 0.5%CVE-2022-32811HIGHA memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, SecEPSS 0.5%CVE-2026-72100HIGHdm-integrity: fix a bug if the bio is out of limitsEPSS 0.5%CVE-2026-31557HIGHnvmet: move async event work off nvmet-wqEPSS 0.5%CVE-2019-14898HIGHThe fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw to obtain sensitive EPSS 0.4%CVE-2026-64232CRITICALblock: recompute nr_integrity_segments in blk_insert_cloned_requestEPSS 0.4%CVE-2024-32648MEDIUMvyper default functions don't respect nonreentrancy keysEPSS 0.4%CVE-2026-20065MEDIUMMultiple Cisco Products Snort 3 TBD Denial of Service VulnerabilityEPSS 0.4%CVE-2021-4149—A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. InEPSS 0.4%