Falhas do tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2026-64846LOWNix: Arbitrary file truncation outside the sandbox with recursive-nix experimental featureEPSS 0.1%CVE-2026-54370HIGHacl < 2.4.0 TOCTOU Symlink Traversal via getfacl/setfacl/chaclEPSS 0.1%CVE-2022-33257CRITICALTime-of-check time-of-use race condition in CoreEPSS 0.1%CVE-2026-59676MEDIUMLocal File Deletion Attack Vector in rm_rf() in seunshareEPSS 0.1%CVE-2026-33574MEDIUMOpenClaw < 2026.3.8 - Path Traversal via Tools Root Rebinding in Skills DownloadEPSS 0.1%CVE-2026-16819HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2024-53032HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS PlatformEPSS 0.1%CVE-2024-53028HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Automotive Vehicle NetworksEPSS 0.1%CVE-2026-86836HIGHIn Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaEPSS 0.1%CVE-2025-64390HIGHA privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox canEPSS 0.1%CVE-2026-2638HIGHX-VPN macOS website versions - Local Privilege EscalationEPSS 0.1%CVE-2023-28576MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel DriverEPSS 0.1%CVE-2022-33214HIGHMemory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon CEPSS 0.1%CVE-2026-53477HIGHDell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileEPSS 0.1%CVE-2026-2364HIGHCODESYS Installer TOCTOU Privilege EscalationEPSS 0.1%CVE-2026-40058HIGHVulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for WindowsEPSS 0.1%CVE-2026-9728MEDIUMTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memoryEPSS 0.1%CVE-2025-22850MEDIUMTime-of-check time-of-use race condition in the UEFI PdaSmm module for some Intel(R) reference platforms may allow an information disclosureEPSS 0.1%CVE-2023-33046HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution EnvironmentEPSS 0.1%CVE-2026-56797HIGHDell Command Update (DCU), versions prior to 5.7.1, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attaEPSS 0.1%