Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-11145MEDIUMRace in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTMEPSS 0.2%CVE-2025-43364HIGHA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26.1. AEPSS 0.2%CVE-2026-7366MEDIUMIBM DataPower Gateway affected by HTTP request header leakage in XML-FirewallEPSS 0.2%CVE-2025-20039MEDIUMRace condition for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentEPSS 0.2%CVE-2024-50183MEDIUMscsi: lpfc: Ensure DA_ID handling completion before deleting an NPIV instanceEPSS 0.2%CVE-2025-37088MEDIUMA security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, EPSS 0.2%CVE-2023-42832HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS VentuEPSS 0.2%CVE-2021-33075MEDIUMRace condition in firmware for some Intel(R) Optane(TM) SSD, Intel(R) Optane(TM) SSD DC and Intel(R) SSD DC Products may allow a privileged EPSS 0.2%CVE-2026-96456MEDIUMReachy Mini Bluetooth PIN authentication can be bypassed by racing an authenticated deviceEPSS 0.2%CVE-2025-15546MEDIUMIptanus File Upload < 5.1.7 - File Overwrite via Race ConditionEPSS 0.2%CVE-2024-22386MEDIUMRace condition vulnerability in Linux kernel drm/exynos exynos_drm_crtc_atomic_disableEPSS 0.2%CVE-2023-49603HIGHRace condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabEPSS 0.2%CVE-2023-48366MEDIUMRace condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabEPSS 0.2%CVE-2026-34856HIGHUAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.2%CVE-2025-64682LOWIn JetBrains Hub before 2025.3.104432 a race condition allowed bypass of the Agent-user limitEPSS 0.2%CVE-2024-53160MEDIUMrcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcuEPSS 0.2%CVE-2022-24114—Local privilege escalation due to race condition on application startupEPSS 0.2%CVE-2026-27814MEDIUMEVerest EvseManager phase-switch path has unsynchronized shared-state access race conditionEPSS 0.2%CVE-2021-33078MEDIUMRace condition within a thread in firmware for some Intel(R) Optane(TM) SSD and Intel(R) SSD DC Products may allow a privileged user to poteEPSS 0.2%CVE-2026-34851LOWRace condition vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect availabilityEPSS 0.2%