Falhas do tipo CWE-367

800 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2025-23279HIGHNVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to escalate privileges. A EPSS 0.1%CVE-2025-9810MEDIUMTOCTOU race in Linenoise enables arbitrary file overwrite and permission changesEPSS 0.1%CVE-2026-32602MEDIUMHomarr has a Race Condition in Invite Token Registration (TOCTOU)EPSS 0.1%CVE-2025-22394MEDIUMDell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privilegeEPSS 0.1%CVE-2026-86836HIGHIn Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaEPSS 0.1%CVE-2026-93683MEDIUMDpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctouEPSS 0.1%CVE-2026-13502LOWantlr ANTLR4 Maven Plugin GrammarDependencies.java ObjectInputStream.readObject toctouEPSS 0.1%CVE-2026-31700HIGHnet/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()EPSS 0.1%CVE-2023-0006MEDIUMGlobalProtect App: Local File Deletion VulnerabilityEPSS 0.1%CVE-2022-3700MEDIUMA Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier thatEPSS 0.1%CVE-2022-23563HIGHInsecure temporary file in TensorflowEPSS 0.1%CVE-2025-58131MEDIUMZoom Workplace VDI Plugin macOS Universal installer for VMware Horizon - Race ConditionEPSS 0.1%CVE-2024-5803HIGHLocal privelage escalation via COM hijackingEPSS 0.1%CVE-2026-21912MEDIUMJunos OS: MX10k Series: 'show system firmware' CLI command may lead to LC480 or LC2101 line card resetEPSS 0.1%CVE-2025-0759LOWIBM EntireX race conditionEPSS 0.1%CVE-2024-5558MEDIUMCWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could cause escalation of privileges when an attacker aEPSS 0.1%CVE-2023-32282HIGHRace condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via lEPSS 0.1%CVE-2026-9728MEDIUMTOCTOU race in mbox_send syscall verifier allows userspace to leak kernel memoryEPSS 0.1%CVE-2025-8192MEDIUMRace condition in AndroidTV TvSettingsEPSS 0.1%CVE-2023-31324HIGHA Time-of-check time-of-use (TOCTOU) race condition in the AMD Secure Processor (ASP) could allow an attacker to modify External Global MemoEPSS 0.1%