Fallos del tipo CWE-667

182 resultados

Sincronização inadequada de acesso a recursos compartilhados

Ocorre quando código que acessa dados ou recursos compartilhados (variáveis globais, arquivos, conexões de banco) não usa mecanismos adequados de sincronização (locks, mutexes, semáforos). Isso permite que múltiplas threads ou processos modifiquem o mesmo recurso simultaneamente, causando corrupção de dados, valores inconsistentes ou comportamento impredizível.

Ejemplo

Uma aplicação multi-thread que incrementa um contador sem lock: duas threads podem ler o valor 100 ao mesmo tempo, incrementar para 101, e ambas escreverem 101 — perdendo uma unidade de incremento. Ou pior: um banco de dados que aceita duas conexões simultâneas atualizando o mesmo saldo, resultando em estados inconsistentes.

Cómo mitigar

Use mutex/lock ao acessar dados compartilhados; prefira estruturas thread-safe da linguagem (ConcurrentHashMap em Java, locks em Python); minimize o escopo e duração de seções críticas; valide e teste cenários de concorrência com ferramentas de análise estática.

CVE-2026-63975HIGHBluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rspEPSS 0.3%CVE-2024-45818MEDIUMDeadlock in x86 HVM standard VGA handlingEPSS 0.3%CVE-2009-2857MEDIUMThe kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtEPSS 0.3%CVE-2026-23136HIGHlibceph: reset sparse-read state in osd_fault()EPSS 0.2%CVE-2025-49178MEDIUMXorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignoreEPSS 0.2%CVE-2021-4147—A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock EPSS 0.2%CVE-2021-41213MEDIUMDeadlock in mutually recursive `tf.function` objectsEPSS 0.2%CVE-2026-61854HIGHVoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growthEPSS 0.2%CVE-2026-105113HIGHNezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex DeadlockEPSS 0.2%CVE-2022-49441MEDIUMtty: fix deadlock caused by calling printk() under tty_port->lockEPSS 0.2%CVE-2025-10151HIGHMalicious TCP/IP thread locking leads into diverse malfunctionsEPSS 0.2%CVE-2025-58153HIGHBIG-IP HSB vulnerabilityEPSS 0.2%CVE-2022-3028—A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_alEPSS 0.2%CVE-2021-22530HIGHImproper account management vulnerability in NetIQ Advance AuthenticationEPSS 0.2%CVE-2024-56531HIGHALSA: caiaq: Use snd_card_free_when_closed() at disconnectionEPSS 0.2%CVE-2022-42328MEDIUMGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vEPSS 0.2%CVE-2025-34467MEDIUMZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative PagesEPSS 0.2%CVE-2022-42329MEDIUMGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vEPSS 0.2%CVE-2026-62426HIGHsysctl and platform-op locks open to abuseEPSS 0.2%CVE-2025-71132HIGHsmc91x: fix broken irq-context in PREEMPT_RTEPSS 0.2%