Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-20926HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.8%CVE-2020-1660HIGHJunos OS: MX Series: Receipt of specific packets can cause services card to restart when DNS filtering is configured.EPSS 0.8%CVE-2021-36532HIGHRace condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhostEPSS 0.8%CVE-2024-6778HIGHRace in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to injecEPSS 0.8%CVE-2022-32895MEDIUMA race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to modify protectedEPSS 0.8%CVE-2022-2854HIGHUse after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via EPSS 0.8%CVE-2025-5054MEDIUMRace Condition in Canonical ApportEPSS 0.8%CVE-2022-22737HIGHConstructing audio sinks could have lead to a race condition when playing audio files and closing windows. This could have lead to a use-aftEPSS 0.8%CVE-2025-30444CRITICALA race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. EPSS 0.8%CVE-2022-2857HIGHUse after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafEPSS 0.8%CVE-2024-54494MEDIUMA race condition was addressed with additional validation. This issue is fixed in iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.EPSS 0.8%CVE-2020-3353MEDIUMCisco Identity Services Engine Denial of Service VulnerabilityEPSS 0.8%CVE-2011-1075—FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new vEPSS 0.8%CVE-2021-20251—A flaw was found in samba. A race condition in the password lockout code may lead to the risk of brute force attacks being successful if speEPSS 0.8%CVE-2023-32570MEDIUMVideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.EPSS 0.8%CVE-2026-20934HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-20848HIGHWindows SMB Server Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2022-3566LOWLinux Kernel TCP tcp_setsockopt race conditionEPSS 0.7%CVE-2022-3307HIGHUse after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 0.7%CVE-2026-42099HIGHRace Condition in Sparx Pro Cloud ServerEPSS 0.7%