Falhas do tipo CWE-667

182 resultados

Sincronização inadequada ou ausente

Ocorre quando código compartilhado por múltiplas threads não usa mecanismos de lock (mutex, semáforo, etc.) para proteger acessos concorrentes a dados. Sem sincronização, dois threads podem ler e escrever o mesmo recurso simultaneamente, causando corrupção de dados, decisões de segurança incorretas ou comportamento imprevisível.

Exemplo

Um contador de tentativas de login compartilhado entre requisições HTTP sem lock: dois requests simultâneos leem o valor 4, incrementam para 5 e escrevem de volta. Resultado: o contador fica 5 em vez de 6, e um atacante consegue mais tentativas que o permitido.

Como mitigar

Use primitivas de sincronização nativa da linguagem (mutex em C/C++, synchronized em Java, Lock em Python) ao acessar dados compartilhados. Se possível, prefira estruturas thread-safe (ConcurrentHashMap, AtomicInteger) ou evite compartilhamento redesenhando a arquitetura (thread-local storage, message passing).

CVE-2026-63975HIGHBluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rspEPSS 0.3%CVE-2024-45818MEDIUMDeadlock in x86 HVM standard VGA handlingEPSS 0.3%CVE-2009-2857MEDIUMThe kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtEPSS 0.3%CVE-2026-23136HIGHlibceph: reset sparse-read state in osd_fault()EPSS 0.2%CVE-2025-49178MEDIUMXorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignoreEPSS 0.2%CVE-2021-4147—A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock EPSS 0.2%CVE-2021-41213MEDIUMDeadlock in mutually recursive `tf.function` objectsEPSS 0.2%CVE-2026-61854HIGHVoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growthEPSS 0.2%CVE-2026-105113HIGHNezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex DeadlockEPSS 0.2%CVE-2022-49441MEDIUMtty: fix deadlock caused by calling printk() under tty_port->lockEPSS 0.2%CVE-2025-10151HIGHMalicious TCP/IP thread locking leads into diverse malfunctionsEPSS 0.2%CVE-2025-58153HIGHBIG-IP HSB vulnerabilityEPSS 0.2%CVE-2022-3028—A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_alEPSS 0.2%CVE-2021-22530HIGHImproper account management vulnerability in NetIQ Advance AuthenticationEPSS 0.2%CVE-2024-56531HIGHALSA: caiaq: Use snd_card_free_when_closed() at disconnectionEPSS 0.2%CVE-2022-42328MEDIUMGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vEPSS 0.2%CVE-2025-34467MEDIUMZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative PagesEPSS 0.2%CVE-2022-42329MEDIUMGuests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vEPSS 0.2%CVE-2026-62426HIGHsysctl and platform-op locks open to abuseEPSS 0.2%CVE-2025-71132HIGHsmc91x: fix broken irq-context in PREEMPT_RTEPSS 0.2%