Falhas do tipo CWE-362

1.433 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2021-0258MEDIUMJunos OS: Kernel panic upon receipt of specific TCPv6 packet on management interfaceEPSS 0.6%CVE-2024-36623HIGHmoby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent writEPSS 0.6%CVE-2022-46174MEDIUMRace condition during concurrent TLS mounts in efs-utilsEPSS 0.6%CVE-2025-43275CRITICALA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.EPSS 0.6%CVE-2024-53476MEDIUMA race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restEPSS 0.6%CVE-2020-1645HIGHJunos OS: MX Series: Services card might restart when DNS filtering is enabledEPSS 0.6%CVE-2024-36621MEDIUMmoby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger EPSS 0.6%CVE-2022-22746MEDIUMA race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticedEPSS 0.6%CVE-2022-3042HIGHUse after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corrupEPSS 0.6%CVE-2019-3016MEDIUMIn a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in theEPSS 0.6%CVE-2023-22499HIGHInteractive permission prompt spoofing in DenoEPSS 0.6%CVE-2026-56188CRITICALWindows Server Network driver Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-59282HIGHInternet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2021-31382MEDIUMJunos OS: PTX1000 System, PTX10002-60C System: After upgrading, configured firewall filters may be applied on incorrect interfacesEPSS 0.6%CVE-2025-43244CRITICALA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 1EPSS 0.6%CVE-2022-22763HIGHWhen a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. TEPSS 0.6%CVE-2025-21278MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 0.6%CVE-2026-43631CRITICALllama.cpp b7492–b9060 Use-After-Free RCE via llama-serverEPSS 0.6%CVE-2026-94043MEDIUMFree5GC Gmm handler.go race conditionEPSS 0.6%CVE-2026-50398HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.6%