Falhas do tipo CWE-820

15 resultados

Falta de Sincronização entre Threads

É quando múltiplas threads acessam e modificam um recurso compartilhado (variável, estrutura de dados, arquivo) sem mecanismo de sincronização (locks, mutexes, semáforos). Isso causa race conditions: o resultado depende da ordem impredizível em que as threads executam, levando a corrupção de dados, crashes ou comportamentos incoerentes.

Exemplo

Um contador global incrementado por 10 threads simultaneamente sem lock: em vez de chegar a 10, pode ficar em 3 ou 7 porque leitura e escrita se sobrepõem. Ou uma lista compartilhada onde uma thread itera enquanto outra remove elementos, causando exceção ou skip de itens.

Como mitigar

Use primitivas de sincronização: locks (mutex), seções críticas, ou estruturas thread-safe (ConcurrentHashMap em Java, concurrent.Lock em Python). Identifique dados compartilhados e proteja-os desde o design. Teste com ferramentas de detecção de race conditions (ThreadSanitizer, Helgrind).

CVE-2023-2801HIGHGrafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sourceEPSS 0.7%CVE-2024-49114HIGHWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2025-47154CRITICALLibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowEPSS 0.7%CVE-2025-49751MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.5%CVE-2025-47999MEDIUMWindows Hyper-V Denial of Service VulnerabilityEPSS 0.4%CVE-2025-1445HIGHA vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61EPSS 0.3%CVE-2026-44318MEDIUMfree5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF process via concurrent map read/write on SubscriptionsEPSS 0.3%CVE-2023-45084HIGHMedia caddy removal and reinsertion without reboot may cause data lossEPSS 0.2%CVE-2022-50238HIGHThe on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. SoEPSS 0.2%CVE-2024-30387HIGHJunos OS: ACX5448 & ACX710: Due to interface flaps the PFE process can crashEPSS 0.2%CVE-2026-57029MEDIUMJunos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crashEPSS 0.1%CVE-2026-53277HIGHKVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulationEPSS 0.1%CVE-2026-53153HIGHmm/list_lru: drain before clearing xarray entry on reparentEPSS 0.1%CVE-2026-22163HIGHGPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPUEPSS 0.1%CVE-2026-70637HIGHLightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.cEPSS —