Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-28996MEDIUMA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, EPSS 0.1%CVE-2025-64118MEDIUMnode-tar vulnerable to race condition leading to uninitialized memory exposureEPSS 0.1%CVE-2026-54229HIGHAbrt: chownproblemdir succeeds during active post-create event processing due to inadequate lockingEPSS 0.1%CVE-2026-62437MEDIUMx86: DMs may cause mem leak by IRQ bindingEPSS 0.1%CVE-2026-16082MEDIUMSipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctouEPSS 0.1%CVE-2026-84607HIGHA race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS EPSS 0.1%CVE-2026-42487HIGHx86 HVM I/O port list traversalEPSS 0.1%CVE-2026-0068CRITICALIn createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO coEPSS 0.1%CVE-2024-23599HIGHRace condition in Seamless Firmware Updates for some Intel(R) reference platforms may allow a privileged user to potentially enable denial oEPSS 0.1%CVE-2026-28926HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.1%CVE-2026-0083CRITICALIn Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privileEPSS 0.1%CVE-2026-16727HIGHConcurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to exeEPSS 0.1%CVE-2024-47974MEDIUMRace condition during resource shutdown in some Solidigm DC Products may allow an attacker to potentially enable denial of service.EPSS 0.1%CVE-2023-42959HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sonoma 14. An app may be able to execute arbitraryEPSS 0.1%CVE-2026-43693HIGHA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.1%CVE-2026-32723MEDIUMSandboxJS timers have an execution-quota bypass (cross-sandbox currentTicks race)EPSS 0.1%CVE-2025-0372MEDIUMConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwordless on Windows alEPSS 0.1%CVE-2023-41833HIGHA race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege viaEPSS 0.1%CVE-2026-48982MEDIUMpam_usb: Missing O_EXCL on pad temp file creation allows concurrent update raceEPSS 0.1%CVE-2026-64717MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6EPSS 0.1%