Fallos del tipo CWE-667

182 resultados

Sincronização inadequada de acesso a recursos compartilhados

Ocorre quando código que acessa dados ou recursos compartilhados (variáveis globais, arquivos, conexões de banco) não usa mecanismos adequados de sincronização (locks, mutexes, semáforos). Isso permite que múltiplas threads ou processos modifiquem o mesmo recurso simultaneamente, causando corrupção de dados, valores inconsistentes ou comportamento impredizível.

Ejemplo

Uma aplicação multi-thread que incrementa um contador sem lock: duas threads podem ler o valor 100 ao mesmo tempo, incrementar para 101, e ambas escreverem 101 — perdendo uma unidade de incremento. Ou pior: um banco de dados que aceita duas conexões simultâneas atualizando o mesmo saldo, resultando em estados inconsistentes.

Cómo mitigar

Use mutex/lock ao acessar dados compartilhados; prefira estruturas thread-safe da linguagem (ConcurrentHashMap em Java, locks em Python); minimize o escopo e duração de seções críticas; valide e teste cenários de concorrência com ferramentas de análise estática.

CVE-2026-43469HIGHxprtrdma: Decrement re_receiving on the early exit pathsEPSS 0.4%CVE-2025-68770HIGHbnxt_en: Fix XDP_TX pathEPSS 0.4%CVE-2023-44119—Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.EPSS 0.4%CVE-2022-2959—A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific flaw exists within thEPSS 0.4%CVE-2025-43510HIGHA memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 andEPSS 0.4%KEVCVE-2025-21900HIGHNFSv4: Fix a deadlock when recovering state on a sillyrenamed fileEPSS 0.4%CVE-2026-46304HIGHnvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_freeEPSS 0.3%CVE-2019-3901MEDIUMA race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particulaEPSS 0.3%CVE-2021-47242HIGHmptcp: fix soft lookup in subflow_error_report()EPSS 0.3%CVE-2026-111879MEDIUMDBI versions before 1.656 for Perl hang on a later open of a DBD::DBM table because a failed open_data does not release the table's lockEPSS 0.3%CVE-2026-80126MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Locking EPSS 0.3%CVE-2026-64534CRITICALnvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error pathEPSS 0.3%CVE-2021-43395MEDIUMAn issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 20EPSS 0.3%CVE-2026-21914HIGHJunos OS: SRX Series: A specifically malformed GTP message will cause an FPC crashEPSS 0.3%CVE-2022-3303MEDIUMA race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference whiEPSS 0.3%CVE-2025-21809HIGHrxrpc, afs: Fix peer hash locking vs RCU callbackEPSS 0.3%CVE-2005-3106MEDIUMRace condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), might allow local users EPSS 0.3%CVE-2023-2612MEDIUMshiftfs lock unbalance in Ubuntu-specific kernelsEPSS 0.3%CVE-2026-106174MEDIUMA improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network aEPSS 0.3%CVE-2026-110803HIGHSession Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8EPSS 0.3%