Falhas do tipo CWE-367

680 resultados

Condição de corrida entre verificação e uso (TOCTOU)

A aplicação verifica uma condição (ex: arquivo existe, usuário tem permissão) e depois atua sobre ela, mas entre a verificação e a ação outro processo pode alterar o estado. Um atacante explora esse intervalo para burlar controles de segurança ou acessar recursos que não deveria.

Exemplo

Um programa verifica se um arquivo é seguro para ler (if (arquivo_existe && nao_eh_symlink)), depois abre e processa. Um atacante substitui o arquivo por um symlink apontando para /etc/passwd entre a verificação e a leitura, conseguindo acessar dados sensíveis.

Como mitigar

Use operações atômicas do SO (open com flags O_NOFOLLOW, O_EXCL; fstat em vez de stat; operações que verificam e atuam em uma única chamada). Implemente locks/mutexes se lógica complexa for necessária, e valide o estado novamente após adquirir recurso.

CVE-2024-45565HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverEPSS 0.1%CVE-2023-33119HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in HypervisorEPSS 0.1%CVE-2024-53016MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverEPSS 0.1%CVE-2025-21431MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS PlatformEPSS 0.1%CVE-2025-20028HIGHTime-of-check time-of-use race condition in the WheaERST SMM module for some Intel(R) reference platforms may allow an escalation of privileEPSS 0.1%CVE-2026-16922HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2024-53018MEDIUMTime-of-check Time-of-use (TOCTOU) Race Condition in Camera DriverEPSS 0.1%CVE-2024-38406HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in CameraEPSS 0.1%CVE-2026-41051MEDIUMcsync2 uses insecure temporary directories when compiled with C99 or laterEPSS 0.1%CVE-2024-45560HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in CameraEPSS 0.1%CVE-2024-38418HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Camera LinuxEPSS 0.1%CVE-2024-38407HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in CameraEPSS 0.1%CVE-2025-21455HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in Camera_LinuxEPSS 0.1%CVE-2026-25271HIGHTime-of-check Time-of-use (TOCTOU) Race Condition in DSP ServiceEPSS 0.1%CVE-2026-6505MEDIUMThe ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. ThEPSS 0.1%CVE-2026-35374MEDIUMuutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race ConditionEPSS 0.1%CVE-2026-3428MEDIUMA Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve prEPSS 0.1%CVE-2026-16896HIGHIBM i is Affected By Multiple Vulnerabilities in Network Authentication ServiceEPSS 0.1%CVE-2026-12374MEDIUMImproper XPC caller certificate validation and TOCTOU race condition in macOS PrivilegedHelperToolEPSS 0.1%CVE-2026-20908MEDIUMTime-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a EPSS 0.1%