Falhas do tipo CWE-362

1.089 resultados

Condição de corrida

Ocorre quando dois ou mais threads/processos acessam um recurso compartilhado (arquivo, memória, banco de dados) quase simultaneamente, e o resultado final depende da ordem de execução que não é controlada. Se a sincronização falha, um thread pode ler ou modificar dados enquanto outro está no meio da operação, causando inconsistência ou comportamento imprevisto.

Exemplo

Um sistema de autenticação que verifica se um arquivo de token existe (sem estar sincronizado): thread A verifica que o arquivo não existe no instante T1, thread B cria o token no instante T2, mas thread A já passou da verificação e cria um novo token conflitante em T3. O resultado depende do timing, não da lógica.

Como mitigar

Use mecanismos de sincronização (locks, mutexes, operações atômicas) ao acessar recursos compartilhados, ou redesenhe a lógica para evitar compartilhamento (cada thread com seu espaço). Para operações de arquivo, use flags de criação exclusiva (O_EXCL em Unix) em vez de verificar-depois-criar.

CVE-2019-3016MEDIUMIn a Linux KVM guest that has PV TLB enabled, a process in the guest kernel may be able to read memory locations from another process in theEPSS 0.6%CVE-2022-3042HIGHUse after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corrupEPSS 0.6%CVE-2024-53476MEDIUMA race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restEPSS 0.6%CVE-2025-59282HIGHInternet Information Services (IIS) Inbox COM Objects (Global Memory) Remote Code Execution VulnerabilityEPSS 0.6%CVE-2025-43275CRITICALA race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.EPSS 0.6%CVE-2026-56188CRITICALWindows Server Network driver Remote Code Execution VulnerabilityEPSS 0.6%CVE-2021-31382MEDIUMJunos OS: PTX1000 System, PTX10002-60C System: After upgrading, configured firewall filters may be applied on incorrect interfacesEPSS 0.6%CVE-2023-22499HIGHInteractive permission prompt spoofing in DenoEPSS 0.6%CVE-2026-45742HIGHGotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')EPSS 0.6%CVE-2022-22746MEDIUMA race condition could have allowed bypassing the fullscreen notification which could have lead to a fullscreen window spoof being unnoticedEPSS 0.6%CVE-2022-46174MEDIUMRace condition during concurrent TLS mounts in efs-utilsEPSS 0.6%CVE-2025-43244CRITICALA race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 1EPSS 0.6%CVE-2025-10263CRITICALArm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-EPSS 0.6%CVE-2025-21278MEDIUMWindows Remote Desktop Gateway (RD Gateway) Denial of Service VulnerabilityEPSS 0.6%CVE-2026-58608HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 0.6%CVE-2026-50398HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-50414HIGHWindows Media Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-23735HIGHConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in graphql-modulesEPSS 0.6%CVE-2023-1672MEDIUMRace condition exists in the key generation and rotation functionalityEPSS 0.6%CVE-2022-22763HIGHWhen a worker is shutdown, it was possible to cause script to run late in the lifecycle, at a point after where it should not be possible. TEPSS 0.6%