Fallos del tipo CWE-667

154 resultados

Sincronização inadequada de acesso a recursos compartilhados

Ocorre quando código que acessa dados ou recursos compartilhados (variáveis globais, arquivos, conexões de banco) não usa mecanismos adequados de sincronização (locks, mutexes, semáforos). Isso permite que múltiplas threads ou processos modifiquem o mesmo recurso simultaneamente, causando corrupção de dados, valores inconsistentes ou comportamento impredizível.

Ejemplo

Uma aplicação multi-thread que incrementa um contador sem lock: duas threads podem ler o valor 100 ao mesmo tempo, incrementar para 101, e ambas escreverem 101 — perdendo uma unidade de incremento. Ou pior: um banco de dados que aceita duas conexões simultâneas atualizando o mesmo saldo, resultando em estados inconsistentes.

Cómo mitigar

Use mutex/lock ao acessar dados compartilhados; prefira estruturas thread-safe da linguagem (ConcurrentHashMap em Java, locks em Python); minimize o escopo e duração de seções críticas; valide e teste cenários de concorrência com ferramentas de análise estática.

CVE-2019-3901MEDIUMA race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particulaEPSS 0.3%CVE-2021-47242HIGHmptcp: fix soft lookup in subflow_error_report()EPSS 0.3%CVE-2026-21914HIGHJunos OS: SRX Series: A specifically malformed GTP message will cause an FPC crashEPSS 0.3%CVE-2023-44119—Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2021-43395MEDIUMAn issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 20EPSS 0.3%CVE-2022-3303MEDIUMA race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference whiEPSS 0.3%CVE-2025-21809HIGHrxrpc, afs: Fix peer hash locking vs RCU callbackEPSS 0.3%CVE-2005-3106MEDIUMRace condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), might allow local users EPSS 0.3%CVE-2023-2612MEDIUMshiftfs lock unbalance in Ubuntu-specific kernelsEPSS 0.3%CVE-2024-45818MEDIUMDeadlock in x86 HVM standard VGA handlingEPSS 0.3%CVE-2009-2857MEDIUMThe kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtEPSS 0.3%CVE-2026-54906LOWconcurrent-ruby: ReadWriteLock allows wrong-thread write release and stray read-release counter corruptionEPSS 0.3%CVE-2021-41213MEDIUMDeadlock in mutually recursive `tf.function` objectsEPSS 0.2%CVE-2021-4147—A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock EPSS 0.2%CVE-2025-49178MEDIUMXorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignoreEPSS 0.2%CVE-2022-49441MEDIUMtty: fix deadlock caused by calling printk() under tty_port->lockEPSS 0.2%CVE-2025-58153HIGHBIG-IP HSB vulnerabilityEPSS 0.2%CVE-2021-22530HIGHImproper account management vulnerability in NetIQ Advance AuthenticationEPSS 0.2%CVE-2022-42328MEDIUMGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vEPSS 0.2%CVE-2024-56531HIGHALSA: caiaq: Use snd_card_free_when_closed() at disconnectionEPSS 0.2%