Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2022-31015MEDIUMUncaught Exception (due to a data race) leads to process termination in WaitressEPSS 1.5%CVE-2018-17244—Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active DirEPSS 1.5%CVE-2015-8963HIGHRace condition in kernel/events/core.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (usEPSS 1.4%CVE-2022-24800HIGHRace Condition in October CMS upload processEPSS 1.4%CVE-2024-49124HIGHLightweight Directory Access Protocol (LDAP) Client Remote Code Execution VulnerabilityEPSS 1.4%CVE-2026-5947HIGHSIG(0) validation during query flood may lead to undefined behaviorEPSS 1.4%CVE-2022-24950—A race condition exists in Eternal Terminal prior to version 6.2.0 that allows an authenticated attacker to hijack other users' SSH authorizEPSS 1.3%CVE-2024-2193MEDIUMSpeculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.EPSS 1.3%CVE-2022-34702HIGHWindows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution VulnerabilityEPSS 1.2%CVE-2022-23639HIGHImproper Restriction of Operations within the Bounds of a Memory Buffer and Race Condition in crossbeam-utilsEPSS 1.2%CVE-2026-20921HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2026-27921HIGHWindows TDI Translation Driver (tdx.sys) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2021-24377—Autoptimize < 2.7.8 - Race Condition leading to RCEEPSS 1.2%CVE-2023-28201CRITICALThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iEPSS 1.2%CVE-2023-27359CRITICALTP-Link AX1800 hotplugd Firewall Rule Race Condition VulnerabilityEPSS 1.2%CVE-2021-3597—A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of serviEPSS 1.1%CVE-2024-43467HIGHWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2022-41039HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-32093HIGHWindows Function Discovery Service (fdwsd.dll) Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2025-32710HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.1%