Fallos del tipo CWE-820

15 resultados

Sincronização ausente entre threads

Ocorre quando múltiplas threads acessam e modificam dados compartilhados sem mecanismos de sincronização (locks, mutexes, semáforos). Isso causa condições de corrida, onde o resultado depende da ordem de execução impredizível, levando a corrupção de dados, comportamento indefinido ou crashes.

Ejemplo

Um contador global incrementado simultaneamente por duas threads sem lock: Thread A lê valor 5, Thread B lê valor 5, ambas somam 1 e escrevem 6 — resultado esperado era 7. Em sistemas críticos, isso pode causar transações duplicadas, estados inconsistentes ou vulnerabilidades exploráveis.

Cómo mitigar

Use primitivas de sincronização nativa da linguagem: mutexes, semáforos, ou operações atômicas. Em Java, use synchronized/ReentrantLock; em C/C++, use std::mutex ou pthreads; em Go, use sync.Mutex. Revise todo acesso a dados compartilhados e cubra com testes de concorrência (race detectors).

CVE-2023-2801HIGHGrafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sourceEPSS 0.7%CVE-2024-49114HIGHWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2025-47154CRITICALLibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowEPSS 0.7%CVE-2025-49751MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.5%CVE-2025-47999MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.4%CVE-2025-1445HIGHA vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61EPSS 0.3%CVE-2026-44318MEDIUMfree5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on SubscriptionsEPSS 0.3%CVE-2023-45084HIGHMedia caddy removal and reinsertion without reboot may cause data lossEPSS 0.2%CVE-2022-50238HIGHThe on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. SoEPSS 0.2%CVE-2024-30387HIGHJunos OS: ACX5448 & ACX710: Due to interface flaps the PFE process can crashEPSS 0.2%CVE-2026-57029MEDIUMJunos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crashEPSS 0.1%CVE-2026-53277HIGHKVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulationEPSS 0.1%CVE-2026-53153HIGHmm/list_lru: drain before clearing xarray entry on reparentEPSS 0.1%CVE-2026-22163HIGHGPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPUEPSS 0.1%CVE-2026-70637HIGHLightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.cEPSS —