Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-23558HIGHgrant table v2 race in status page mappingEPSS 0.1%CVE-2026-10681MEDIUMSMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slotEPSS 0.1%CVE-2026-43781MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.1%CVE-2026-43770MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.EPSS 0.1%CVE-2025-39927HIGHceph: fix race condition validating r_parent before applying stateEPSS 0.1%CVE-2025-25278HIGHliteos_a has a race condition vulnerabilityEPSS 0.1%CVE-2023-52720MEDIUMRace condition vulnerability in the soundtrigger module Impact: Successful exploitation of this vulnerability will affect availability.EPSS 0.1%CVE-2025-68957HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.1%CVE-2026-13502LOWantlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctouEPSS 0.1%CVE-2026-43811MEDIUMA race condition was addressed with improved checks. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6. An appEPSS 0.1%CVE-2025-68958HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.1%CVE-2026-84550MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7EPSS 0.1%CVE-2026-43659MEDIUMA race condition was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, maEPSS 0.1%CVE-2026-43755HIGHA race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be aEPSS 0.1%CVE-2023-53310MEDIUMpower: supply: axp288_fuel_gauge: Fix external_power_changed raceEPSS 0.1%CVE-2026-65358MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS SequoiEPSS 0.1%CVE-2026-84630MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoEPSS 0.1%CVE-2022-20567HIGHIn pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privileEPSS 0.1%CVE-2026-84492MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoEPSS 0.1%CVE-2026-65401MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be abEPSS 0.1%