Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2021-3597—A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of serviEPSS 1.2%CVE-2024-43467HIGHWindows Remote Desktop Licensing Service Remote Code Execution VulnerabilityEPSS 1.1%CVE-2026-32093HIGHWindows Function Discovery Service (fdwsd.dll) Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2022-3623MEDIUMLinux Kernel BPF gup.c follow_page_pte race conditionEPSS 1.1%CVE-2025-32710HIGHWindows Remote Desktop Services Remote Code Execution VulnerabilityEPSS 1.1%CVE-2022-24949—A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, bufferEPSS 1.1%CVE-2013-1294HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 1.1%CVE-2018-15687HIGHsystemd: chown_one() can dereference symlinksEPSS 1.1%CVE-2013-1265HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1275HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1253HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2021-20316—A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or moEPSS 1.0%CVE-2023-3758HIGHSssd: race condition during authorization leads to gpo policies functioning inconsistentlyEPSS 1.0%CVE-2020-25668—A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free iEPSS 1.0%CVE-2019-7614—A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system withEPSS 1.0%CVE-2023-21712HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.0%CVE-2020-15706MEDIUMGRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.EPSS 1.0%CVE-2022-24751MEDIUMRace condition in ZulipEPSS 1.0%CVE-2026-94300HIGHConcurrent GSS-TSIG messages corrupt memoryEPSS 1.0%CVE-2021-44731HIGHsnapd could be made to escalate privileges and run programs as administratorEPSS 1.0%