Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2022-49580MEDIUMipv4: Fix a data-race around sysctl_fib_multipath_use_neigh.EPSS 0.2%CVE-2022-49596MEDIUMtcp: Fix data-races around sysctl_tcp_min_snd_mss.EPSS 0.2%CVE-2025-49737HIGHMicrosoft Teams Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2022-49577MEDIUMudp: Fix a data-race around sysctl_udp_l3mdev_accept.EPSS 0.2%CVE-2024-24855MEDIUMRace condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()EPSS 0.2%CVE-2026-7954LOWRace in Shared Storage in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak crEPSS 0.2%CVE-2025-21688MEDIUMdrm/v3d: Assign job pointer to NULL before signaling the fenceEPSS 0.2%CVE-2026-87641MEDIUMRace condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a craftEPSS 0.2%CVE-2026-76393MEDIUMRace Condition during Model Upload through the REST API in Splunk AI ToolkitEPSS 0.2%CVE-2026-9959LOWRace in WebRTC in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML paEPSS 0.2%CVE-2021-46925HIGHnet/smc: fix kernel panic caused by race of smc_sockEPSS 0.2%CVE-2022-49634MEDIUMsysctl: Fix data-races in proc_dou8vec_minmax().EPSS 0.2%CVE-2026-25184HIGHApplocker Filter Driver (applockerfltr.sys) Elevation of Privilege VulnerabilityEPSS 0.2%CVE-2022-42832MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privEPSS 0.2%CVE-2022-42831MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app with root privEPSS 0.2%CVE-2025-10216LOWGrandNode Voucher ConfirmOrder race conditionEPSS 0.2%CVE-2024-24864MEDIUMRace condition vulnerability in Linux kernel media/dvb-core in dvbdmx_write()EPSS 0.2%CVE-2024-33904HIGHIn plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arbEPSS 0.2%CVE-2023-52825HIGHdrm/amdkfd: Fix a race condition of vram buffer unref in svm codeEPSS 0.2%CVE-2024-38628HIGHusb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.EPSS 0.2%