Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2018-10850MEDIUM389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting EPSS 1.5%CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.5%CVE-2022-24800HIGHRace Condition in October CMS upload processEPSS 1.5%CVE-2018-17244—Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active DirEPSS 1.5%CVE-2015-8963HIGHRace condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (usEPSS 1.4%CVE-2024-49124HIGHLightweight Directory Access Protocol (LDAP) Client Remote Code Execution VulnerabilityEPSS 1.4%CVE-2022-41039HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-5947HIGHSIG(0) validation during query flood may lead to undefined behaviorEPSS 1.4%CVE-2022-24950—A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorizEPSS 1.3%CVE-2022-34702HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 1.3%CVE-2022-39328CRITICALGrafana vulnerable to race condition allowing privilege escalationEPSS 1.3%CVE-2022-27626CRITICALA vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessioEPSS 1.3%CVE-2024-2193MEDIUMSpeculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.EPSS 1.3%CVE-2022-23639HIGHImproper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilsEPSS 1.2%CVE-2025-25214HIGHA race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. EPSS 1.2%CVE-2026-27921HIGHWindows TDI Translation Driver (tdx.sys) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2021-24377—Autoptimize < 2.7.8 - Race Condition leading to RCEEPSS 1.2%CVE-2026-20921HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2023-28201CRITICALThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iEPSS 1.2%CVE-2023-27359CRITICALTP-Link AX1800 hotplugd Firewall Rule Race Condition VulnerabilityEPSS 1.2%