Falhas do tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2022-32471HIGHAn issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass inpEPSS 0.1%CVE-2022-32953HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the SdHostDriver buffer used by SMM and non-SMM codeEPSS 0.1%CVE-2022-32475HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM andEPSS 0.1%CVE-2022-32470HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FwBlockServiceSmm shared buffer used by SMM and EPSS 0.1%CVE-2022-32474HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the StorageSecurityCommandDxe shared buffer used by EPSS 0.1%CVE-2022-32473HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the HddPassword shared buffer used by SMM and non-SMEPSS 0.1%CVE-2022-32469HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the PnpSmm shared buffer used by SMM and non-SMM codEPSS 0.1%CVE-2026-53796MEDIUMrsync < 3.5.0 TOCTOU Race Condition via Destination Directory HandlingEPSS 0.1%CVE-2026-79730MEDIUMDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check TimeEPSS 0.1%CVE-2022-32478HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM EPSS 0.1%CVE-2022-32477HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FvbServicesRuntimeDxe shared buffer used by SMM EPSS 0.1%CVE-2026-32979HIGHOpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host ApprovalEPSS 0.1%CVE-2022-32476HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the AhciBusDxe shared buffer used by SMM and non-SMMEPSS 0.1%CVE-2025-13818HIGHLocal privilege escalation in ESET Management Agent for WindowsEPSS 0.1%CVE-2026-82429HIGHApache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker LauncherEPSS 0.1%CVE-2022-42917MEDIUMIn FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/EPSS 0.1%CVE-2026-49262LOWAimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxyEPSS 0.1%CVE-2026-24067HIGHSlate Digital Connect macOS XPC PID validation privilege escalationEPSS 0.1%CVE-2026-11835MEDIUMCaliptra Update-Reset Secure-Boot Bypass via Attacker-Chosen AXI Staging Address (TOCTOU)EPSS 0.1%CVE-2025-46415LOWA race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders. This affects Nix before 2.EPSS 0.1%