Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-50672HIGHWindows NTFS Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-32083HIGHWindows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-54996HIGHWindows USB Print Driver Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-62705HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-62690HIGHWindows Push Notifications Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2026-50345HIGHWindows Runtime Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-35899HIGHnetfilter: nf_tables: flush pending destroy work before exit_net releaseEPSS 0.2%CVE-2022-31645HIGHPotential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escEPSS 0.2%CVE-2023-35823HIGHAn issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134EPSS 0.2%CVE-2024-7017HIGHInappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandboxEPSS 0.2%CVE-2025-59205HIGHWindows Graphics Component Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2023-35824HIGHAn issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.EPSS 0.2%CVE-2022-32844MEDIUMA race condition was addressed with improved state handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An appEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%CVE-2024-54510MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, maEPSS 0.2%CVE-2022-49599MEDIUMtcp: Fix data-races around sysctl_tcp_l3mdev_accept.EPSS 0.2%CVE-2025-58727HIGHWindows Connected Devices Platform Service Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2024-50174HIGHdrm/panthor: Fix race when converting group handle to group objectEPSS 0.2%CVE-2026-9030MEDIUMAuthenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6EPSS 0.2%CVE-2025-24240MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.EPSS 0.2%