Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2024-56441MEDIUMRace condition vulnerability in the Bastet module Impact: Successful exploitation of this vulnerability may affect service confidentiality.EPSS 0.1%CVE-2025-64168HIGHAgno session state overwrites between different sessions/usersEPSS 0.1%CVE-2024-36285MEDIUMRace condition in some Intel(R) PROSet/Wireless WiFi and Killerâ„¢ WiFi software for Windows before version 23.80 may allow an authenticatedEPSS 0.1%CVE-2026-11253MEDIUMInappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via EPSS 0.1%CVE-2024-54120MEDIUMRace condition vulnerability in the distributed notification module Impact: Successful exploitation of this vulnerability may cause featuresEPSS 0.1%CVE-2026-26070MEDIUMEVerest: OCPP 2.0.1 EV SoC Update Race Causes Charge Point CrashEPSS 0.1%CVE-2023-42974HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 anEPSS 0.1%CVE-2026-11677HIGHRace in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to potentiEPSS 0.1%CVE-2024-36262HIGHRace condition in some Intel(R) System Security Report and System Resources Defense firmware may allow a privileged user to potentially enabEPSS 0.1%CVE-2024-26942MEDIUMnet: phy: qcom: at803x: fix kernel panic with at8031_probeEPSS 0.1%CVE-2026-12454HIGHRace in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to EPSS 0.1%CVE-2025-21984HIGHmm: fix kernel BUG when userfaultfd_move encounters swapcacheEPSS 0.1%CVE-2026-78915HIGHRace condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitEPSS 0.1%CVE-2026-12468HIGHRace in Updater in Google Chrome on Mac prior to 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentEPSS 0.1%CVE-2022-49920HIGHnetfilter: nf_tables: netlink notifier might race to release objectsEPSS 0.1%CVE-2023-45864MEDIUMA race condition issue discovered in Samsung Mobile Processor Exynos 9820, 980, 1080, 2100, 2200, 1280, and 1380 allows unintended modificatEPSS 0.1%CVE-2026-48066MEDIUMpam_usb: Thread-unsafe static pointer in log.c causes data race under concurrent PAM authenticationEPSS 0.1%CVE-2026-18151MEDIUMIBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.EPSS 0.1%CVE-2026-62294MEDIUMFlameshot: OCTOU symlink attack via predictable /tmp path in Flameshot "Open With"EPSS 0.1%CVE-2023-53020MEDIUMl2tp: close all race conditions in l2tp_tunnel_register()EPSS 0.1%