Falhas do tipo CWE-362

1.090 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2022-20567HIGHIn pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local escalation of privileEPSS 0.1%CVE-2026-65360MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS GoEPSS 0.1%CVE-2025-39905HIGHnet: phylink: add lock for serializing concurrent pl->phydev writes with resolverEPSS 0.1%CVE-2026-61079MEDIUMVulnerability in Oracle GoldenGate (component: Libraries). Supported versions that are affected are 19.1.0.0.0-19.30.0.0, 21.3-21.21 and 2EPSS 0.1%CVE-2022-50379MEDIUMbtrfs: fix race between quota enable and quota rescan ioctlEPSS 0.1%CVE-2025-64345LOWWasmtime provides unsound API access to a WebAssembly shared linear memoryEPSS 0.1%CVE-2026-41964HIGHPermission control vulnerability in the web. Impact: Successful exploitation of this vulnerability may affect availability.EPSS 0.1%CVE-2026-43690MEDIUMA race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A lEPSS 0.1%CVE-2026-20617HIGHA race condition was addressed with improved state handling. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS SoEPSS 0.1%CVE-2025-68955HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avEPSS 0.1%CVE-2026-43743MEDIUMA race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, EPSS 0.1%CVE-2025-68956HIGHMulti-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaEPSS 0.1%CVE-2026-58088HIGHRace condition in ELF core dump segment countingEPSS 0.1%CVE-2026-28830MEDIUMA race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.4. An app may be able to access sensitive uEPSS 0.1%CVE-2022-50339HIGHBluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev()EPSS 0.1%CVE-2025-27577HIGHliteos_a has a race condition vulnerabilityEPSS 0.1%CVE-2026-32848MEDIUMNetBSD cryptodev Race Condition Double-Free via cryptodev_op()EPSS 0.1%CVE-2025-48548HIGHIn multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the privacy indicator due to EPSS 0.1%CVE-2026-11812LOWUpdateHub: race condition on shared context causes out-of-bounds write and DoSEPSS 0.1%CVE-2023-31225LOWThe Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect prodEPSS 0.1%