Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2023-1582MEDIUMA race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue may allow a local attaEPSS 0.1%CVE-2024-43701HIGHGPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devicesEPSS 0.1%CVE-2026-7351LOWRace in MHTML in Google Chrome prior to 147.0.7727.138 allowed an attacker who convinced a user to install a malicious extension to leak croEPSS 0.1%CVE-2026-3006HIGHRace Condition VulnerabilityEPSS 0.1%CVE-2026-47270MEDIUMpam_usb: strtok() race condition in multi-threaded PAM hosts can corrupt deny_remote resultEPSS 0.1%CVE-2026-43783HIGHA race condition was addressed with improved locking. This issue is fixed in macOS Tahoe 26.6. A malicious app may be able to gain root privEPSS 0.1%CVE-2026-22701MEDIUMfilelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockEPSS 0.1%CVE-2026-27189MEDIUMOpenSift: Race-prone local persistence could cause state corruption/lossEPSS 0.1%CVE-2026-35099HIGHLakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. The fixed versions areEPSS 0.1%CVE-2026-54778MEDIUMCoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity ResolutionEPSS 0.1%CVE-2026-28834MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 2EPSS 0.1%CVE-2025-30513HIGHRace condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privilegEPSS 0.1%CVE-2025-33235HIGHNVIDIA Resiliency Extension for Linux contains a vulnerability in the checkpointing core, where an attacker may cause a race condition. A suEPSS 0.1%CVE-2025-52993MEDIUMA race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the builEPSS 0.1%CVE-2026-13198MEDIUMConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControlEPSS 0.1%CVE-2026-13197HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in KUNBUS piControlEPSS 0.1%CVE-2024-52906MEDIUMIBM AIX denial of serviceEPSS 0.1%CVE-2026-60161MEDIUMVulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.EPSS 0.1%CVE-2026-28888MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 2EPSS 0.1%CVE-2025-61480HIGHAn issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofEPSS 0.1%