Falhas do tipo CWE-667

154 resultados

Sincronização inadequada ou ausente

Ocorre quando código compartilhado por múltiplas threads não usa mecanismos de lock (mutex, semáforo, etc.) para proteger acessos concorrentes a dados. Sem sincronização, dois threads podem ler e escrever o mesmo recurso simultaneamente, causando corrupção de dados, decisões de segurança incorretas ou comportamento imprevisível.

Exemplo

Um contador de tentativas de login compartilhado entre requisições HTTP sem lock: dois requests simultâneos leem o valor 4, incrementam para 5 e escrevem de volta. Resultado: o contador fica 5 em vez de 6, e um atacante consegue mais tentativas que o permitido.

Como mitigar

Use primitivas de sincronização nativa da linguagem (mutex em C/C++, synchronized em Java, Lock em Python) ao acessar dados compartilhados. Se possível, prefira estruturas thread-safe (ConcurrentHashMap, AtomicInteger) ou evite compartilhamento redesenhando a arquitetura (thread-local storage, message passing).

CVE-2024-57807MEDIUMscsi: megaraid_sas: Fix for a potential deadlockEPSS 0.2%CVE-2022-4129MEDIUMA flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condiEPSS 0.2%CVE-2024-53207HIGHBluetooth: MGMT: Fix possible deadlocksEPSS 0.2%CVE-2025-21674MEDIUMnet/mlx5e: Fix inversion dependency warning while enabling IPsec tunnelEPSS 0.2%CVE-2024-50294HIGHrxrpc: Fix missing locking causing hanging callsEPSS 0.2%CVE-2024-58071MEDIUMteam: prevent adding a device which is already a team device lowerEPSS 0.2%CVE-2025-21851HIGHbpf: Fix softlockup in arena_map_free on 64k page kernelEPSS 0.2%CVE-2024-47141MEDIUMpinmux: Use sequential access to access desc->pinmux dataEPSS 0.2%CVE-2022-49123MEDIUMath11k: Fix frames flush failure caused by deadlockEPSS 0.2%CVE-2024-50210MEDIUMposix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()EPSS 0.2%CVE-2024-43098MEDIUMi3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlockEPSS 0.2%CVE-2022-49296MEDIUMceph: fix possible deadlock when holding Fwb to get inline_dataEPSS 0.2%CVE-2025-21859MEDIUMUSB: gadget: f_midi: f_midi_complete to call queue_workEPSS 0.2%CVE-2022-49496MEDIUMmedia: mediatek: vcodec: prevent kernel crash when rmmod mtk-vcodec-dec.koEPSS 0.2%CVE-2022-49303MEDIUMdrivers: staging: rtl8192eu: Fix deadlock in rtw_joinbss_event_prehandleEPSS 0.2%CVE-2022-49547MEDIUMbtrfs: fix deadlock between concurrent dio writes when low on free data spaceEPSS 0.2%CVE-2024-58042MEDIUMrhashtable: Fix potential deadlock by moving schedule_work outside lockEPSS 0.2%CVE-2024-57946MEDIUMvirtio-blk: don't keep queue frozen during system suspendEPSS 0.2%CVE-2021-0147MEDIUMImproper locking in the Power Management Controller (PMC) for some Intel Chipset firmware before versions pmc_fw_lbg_c1-21ww02a and pmc_fw_lEPSS 0.2%CVE-2024-32900CRITICALIn lwis_fence_signal of lwis_debug.c, there is a possible Use after Free due to improper locking. This could lead to local escalation of priEPSS 0.2%