Falhas do tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2022-31243MEDIUMUpdate description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesREPSS 0.2%CVE-2025-30101MEDIUMDell PowerScale OneFS, versions 9.8.0.0 through 9.10.1.0, contain a time-of-check time-of-use (TOCTOU) race condition vulnerability. An unauEPSS 0.2%CVE-2024-47813LOWWasmtime race condition could lead to WebAssembly control-flow integrity and type safety violationsEPSS 0.2%CVE-2026-24071HIGHXPC Client Validation via PID leading to Local Privilege Escalation in Native Instruments Native AccessEPSS 0.2%CVE-2026-29518HIGHRsync < 3.4.3 TOCTOU Race Condition Allows Symlink-Based Arbitrary File WriteEPSS 0.2%CVE-2026-42344MEDIUMFastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpointsEPSS 0.1%CVE-2026-35352HIGHuutils coreutils mkfifo Privilege Escalation via TOCTOU Race ConditionEPSS 0.1%CVE-2025-30663HIGHZoom Workplace Apps - Time-of-check Time-of-useEPSS 0.1%CVE-2022-21198HIGHTime-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enableEPSS 0.1%CVE-2021-33632HIGHTOCTOU Race Condition problem in iSuladEPSS 0.1%CVE-2024-41917MEDIUMTime-of-check time-of-use race condition for some Intel(R) Battery Life Diagnostic Tool software before version 2.4.1 may allow an authenticEPSS 0.1%CVE-2026-3590MEDIUMRace Condition in Guest Magic Link Authentication Allows Token ReuseEPSS 0.1%CVE-2026-79968MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check TimeEPSS 0.1%CVE-2026-55567HIGHBleachBit: Exploit File Delete to Escalate PrivilegeEPSS 0.1%CVE-2022-24413MEDIUMDell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with access to the filesysteEPSS 0.1%CVE-2023-52556MEDIUMOpenBSD 7.4 pf state race condition kernel crashEPSS 0.1%CVE-2026-53797MEDIUMrsync < 3.5.0 Symlink Race Condition Information DisclosureEPSS 0.1%CVE-2025-54271MEDIUMCreative Cloud Desktop | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)EPSS 0.1%CVE-2026-5958LOWRace Condition in GNU SedEPSS 0.1%CVE-2026-77573LOWWeblate: DNS rebinding in VCS operations allows server-side request forgeryEPSS 0.1%