Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2026-50369HIGHWindows Remote Desktop Services Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2026-56649MEDIUMWindows Network File System Remote Code Execution VulnerabilityEPSS 0.7%CVE-2022-3566LOWLinux Kernel TCP tcp_setsockopt race conditionEPSS 0.7%CVE-2018-3759—private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the sockEPSS 0.7%CVE-2023-0739HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answerEPSS 0.7%CVE-2020-1667HIGHJunos OS: MX Series: Services card might restart due to a race condition when DNS filtering is enabled.EPSS 0.7%CVE-2024-27823MEDIUMA race condition was addressed with improved locking. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS MEPSS 0.7%CVE-2021-21005HIGHRace Condition Vulnerability in Phoenix Contact FL SWITCH SMCS series productsEPSS 0.7%CVE-2022-3307HIGHUse after free in media in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to potentially exploit heap corruption via a craftEPSS 0.7%CVE-2022-2160MEDIUMInsufficient policy enforcement in DevTools in Google Chrome on Windows prior to 103.0.5060.53 allowed an attacker who convinced a user to iEPSS 0.7%CVE-2025-50169HIGHWindows SMB Remote Code Execution VulnerabilityEPSS 0.7%CVE-2021-31364MEDIUMJunos OS: SRX Series: The flowd process will crash if log session-close is configured and specific traffic is receivedEPSS 0.7%CVE-2022-3049HIGHUse after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user toEPSS 0.7%CVE-2026-70091MEDIUMWindows DNS Denial of Service VulnerabilityEPSS 0.7%CVE-2016-20015HIGHIn the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any EPSS 0.6%CVE-2021-0258MEDIUMJunos OS: Kernel panic upon receipt of specific TCPv6 packet on management interfaceEPSS 0.6%CVE-2024-36623HIGHmoby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent writEPSS 0.6%CVE-2022-4037MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versioEPSS 0.6%CVE-2020-1645HIGHJunos OS: MX Series: Services card might restart when DNS filtering is enabledEPSS 0.6%CVE-2024-36621MEDIUMmoby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger EPSS 0.6%