Falhas do tipo CWE-362

943 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 98.9%KEVCVE-2018-15473MEDIUMOpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after EPSS 98.6%CVE-2024-27983HIGHAn attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 fEPSS 87.2%CVE-2016-5195HIGHRace condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect haEPSS 83.0%KEVCVE-2023-28126MEDIUMAn authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploitinEPSS 66.7%CVE-2022-46689HIGHA race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOEPSS 44.7%CVE-2021-21166HIGHData race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTMEPSS 23.8%KEVCVE-2014-0196MEDIUMThe n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO EPSS 22.5%KEVCVE-2024-28999MEDIUMSolarWinds Platform Race Condition VulnerabilityEPSS 13.9%CVE-2010-0021MEDIUMMultiple race conditions in the SMB implementation in the Server service in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 EPSS 13.5%CVE-2017-2619—Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the servEPSS 11.2%CVE-2022-26904HIGHWindows User Profile Service Elevation of Privilege VulnerabilityEPSS 9.8%KEVCVE-2025-21376HIGHWindows Lightweight Directory Access Protocol (LDAP) Remote Code Execution VulnerabilityEPSS 9.4%CVE-2023-40077CRITICALIn multiple functions of MetaDataBase.cpp, there is a possible UAF write due to a race condition. This could lead to remote escalation of prEPSS 8.4%CVE-2018-1049—In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be servEPSS 7.2%CVE-2020-6820HIGHUnder certain conditions, when handling a ReadableStream, a race condition can cause a use-after-free. We are aware of targeted attacks in tEPSS 6.3%KEVCVE-2025-62215HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 6.0%KEVCVE-2024-48991HIGHQualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by winning a race conditionEPSS 5.3%CVE-2024-20700HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 4.0%CVE-2025-50177HIGHMicrosoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityEPSS 3.9%