Falhas do tipo CWE-667

154 resultados

Sincronização inadequada ou ausente

Ocorre quando código compartilhado por múltiplas threads não usa mecanismos de lock (mutex, semáforo, etc.) para proteger acessos concorrentes a dados. Sem sincronização, dois threads podem ler e escrever o mesmo recurso simultaneamente, causando corrupção de dados, decisões de segurança incorretas ou comportamento imprevisível.

Exemplo

Um contador de tentativas de login compartilhado entre requisições HTTP sem lock: dois requests simultâneos leem o valor 4, incrementam para 5 e escrevem de volta. Resultado: o contador fica 5 em vez de 6, e um atacante consegue mais tentativas que o permitido.

Como mitigar

Use primitivas de sincronização nativa da linguagem (mutex em C/C++, synchronized em Java, Lock em Python) ao acessar dados compartilhados. Se possível, prefira estruturas thread-safe (ConcurrentHashMap, AtomicInteger) ou evite compartilhamento redesenhando a arquitetura (thread-local storage, message passing).

CVE-2025-20044MEDIUMImproper locking for some Intel(R) TDX Module firmware before version 1.5.13 may allow a privileged user to potentially enable escalation ofEPSS 0.1%CVE-2025-39915MEDIUMnet: phy: transfer phy_config_inband() locking responsibility to phylinkEPSS 0.1%CVE-2023-20618MEDIUMIn vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2023-20619MEDIUMIn vcu, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2023-21000HIGHIn MediaCodec.cpp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no addiEPSS 0.1%CVE-2026-42489MEDIUMdomctl lock open to abuseEPSS 0.1%CVE-2023-20733MEDIUMIn vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2023-20743MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20737MEDIUMIn vcu, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2023-20745MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20746MEDIUMIn vcu, there is a possible out of bounds write due to improper locking. This could lead to local escalation of privilege with System executEPSS 0.1%CVE-2023-20939HIGHIn multiple functions of looper_backed_event_loop.cpp, there is a possible way to corrupt memory due to improper locking. This could lead toEPSS 0.1%CVE-2026-20757LOWImproper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service iEPSS 0.1%CVE-2026-56914HIGHIn multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no EPSS 0.1%