Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2013-1294HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 1.1%CVE-2022-27626CRITICALA vulnerability regarding concurrent execution using shared resource with improper synchronization ('Race Condition') is found in the sessioEPSS 1.1%CVE-2018-15687HIGHsystemd: chown_one() can dereference symlinksEPSS 1.1%CVE-2013-1253HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1275HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2013-1265HIGHRace condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, WinEPSS 1.0%CVE-2022-39328CRITICALGrafana vulnerable to race condition allowing privilege escalationEPSS 1.0%CVE-2023-3758HIGHSssd: race condition during authorization leads to gpo policies functioning inconsistentlyEPSS 1.0%CVE-2025-25214HIGHA race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. EPSS 1.0%CVE-2022-24949—A privilege escalation to root exists in Eternal Terminal prior to version 6.2.0. This is due to the combination of a race condition, bufferEPSS 1.0%CVE-2020-25668—A flaw was found in Linux Kernel because access to the global variable fg_console is not properly synchronized leading to a use after free iEPSS 1.0%CVE-2019-7614—A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system withEPSS 1.0%CVE-2023-21712HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 1.0%CVE-2021-20316—A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or moEPSS 1.0%CVE-2020-15706MEDIUMGRUB2 contains a race condition leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing.EPSS 1.0%CVE-2022-24751MEDIUMRace condition in ZulipEPSS 1.0%CVE-2021-44731HIGHsnapd could be made to escalate privileges and run programs as administratorEPSS 1.0%CVE-2013-1278HIGHRace condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, aEPSS 0.9%CVE-2026-20927MEDIUMWindows SMB Server Denial of Service VulnerabilityEPSS 0.9%CVE-2023-28232HIGHWindows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityEPSS 0.9%