Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2022-34696HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2024-24255MEDIUMA Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send dEPSS 0.3%CVE-2026-5120HIGHRace Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026EPSS 0.3%CVE-2020-25653—A race condition vulnerability was found in the way the spice-vdagentd daemon handled new client connections. This flaw may allow an unpriviEPSS 0.3%CVE-2024-11708MEDIUMMissing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. This vulnerability affecEPSS 0.3%CVE-2022-44032MEDIUMAn issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-freeEPSS 0.3%CVE-2025-47545MEDIUMWordPress Poll Maker plugin <= 5.7.7 - Race Condition VulnerabilityEPSS 0.3%CVE-2025-47735LOWinner::drop in inner.rs in the wgp crate through 0.2.0 for Rust lacks drop_slow thread synchronization.EPSS 0.3%CVE-2026-20844HIGHWindows Clipboard Server Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-1013MEDIUMPotential opening of private browsing tabs in normal browsing windowsEPSS 0.3%CVE-2024-24858MEDIUMRace condition vulnerability in Linux kernel net/bluetooth in {conn,adv}_{min,max}_interval_set()EPSS 0.3%CVE-2025-33254HIGHNVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this EPSS 0.3%CVE-2025-33238HIGHNVIDIA Triton Inference Server Sagemaker HTTP server contains a vulnerability where an attacker may cause an exception. A successful exploitEPSS 0.3%CVE-2026-22856MEDIUMFreeRDP has a heap-use-after-free in create_irp_threadEPSS 0.3%CVE-2025-1801HIGHAap-gateway: aap-gateway privilege escalationEPSS 0.3%CVE-2025-46336MEDIUMRack session gets restored after deletionEPSS 0.3%CVE-2025-55224HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-53768HIGHXbox IStorageService Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2025-55228HIGHWindows Graphics Component Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-53150HIGHWindows Digital Media Elevation of Privilege VulnerabilityEPSS 0.3%