Falhas do tipo CWE-367

799 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2024-48394HIGHA Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprEPSS 0.1%CVE-2026-53145HIGHdrm/gem: Try to fix change_handle ioctl, attempt 4EPSS 0.1%CVE-2022-26859MEDIUMDell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in oEPSS 0.1%CVE-2025-46327LOWGo Snowflake Driver has race condition when checking access to Easy Logging configuration fileEPSS 0.1%CVE-2026-63937HIGHKVM: SEV: Use READ_ONCE() when reading entries/indices from PSC bufferEPSS 0.1%CVE-2026-55567HIGHBleachBit: Exploit File Delete to Escalate PrivilegeEPSS 0.1%CVE-2024-42446HIGHTOCTOU in SmmWheaEPSS 0.1%CVE-2026-54228HIGHAbrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directoriesEPSS 0.1%CVE-2025-64118MEDIUMnode-tar vulnerable to race condition leading to uninitialized memory exposureEPSS 0.1%CVE-2026-32979HIGHOpenClaw < 2026.3.11 - Unbound Interpreter and Runtime Commands Bypass in node-host ApprovalEPSS 0.1%CVE-2022-32474HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the StorageSecurityCommandDxe shared buffer used by EPSS 0.1%CVE-2022-32469HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the PnpSmm shared buffer used by SMM and non-SMM codEPSS 0.1%CVE-2022-32954HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5. DMA attacks on the SdMmcDevice buffer used by SMM and non-SMM code EPSS 0.1%CVE-2022-32478HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM EPSS 0.1%CVE-2026-112935MEDIUMfilelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holdersEPSS 0.1%CVE-2022-32470HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FwBlockServiceSmm shared buffer used by SMM and EPSS 0.1%CVE-2025-20074HIGHTime-of-check Time-of-use race condition for some Intel(R) Connectivity Performance Suite software installers before version 40.24.11210 mayEPSS 0.1%CVE-2022-32475HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the VariableRuntimeDxe shared buffer used by SMM andEPSS 0.1%CVE-2022-32476HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the AhciBusDxe shared buffer used by SMM and non-SMMEPSS 0.1%CVE-2022-32955HIGHAn issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the NvmExpressDxe buffer used by SMM and non-SMM codEPSS 0.1%