Fallos del tipo CWE-662

17 resultados

Sincronização inadequada entre threads

Ocorre quando múltiplas threads acessam e modificam dados compartilhados sem mecanismos de sincronização (locks, mutexes, semáforos). Isso causa race conditions, onde o resultado depende da ordem de execução das threads, levando a corrupção de dados, travamentos ou comportamento imprevisível.

Ejemplo

Um contador de usuários simultâneos em uma aplicação web: duas requisições leem o valor 100, ambas incrementam para 101 e escrevem de volta. O resultado deveria ser 102, mas é apenas 101. Se esse contador controla limites críticos, o sistema fica vulnerável.

Cómo mitigar

Use primitivas de sincronização nativa da linguagem (synchronized em Java, locks em Python, mutexes em C), ferramentas de detecção estática (thread sanitizers), e testes com alto grau de concorrência. Para dados compartilhados críticos, considere estruturas thread-safe ou design que evite compartilhamento direto.

CVE-2024-7409HIGHQemu: denial of service via improper synchronization in qemu nbd server during socket closureEPSS 1.0%CVE-2024-32644CRITICALEvmos' transaction execution not accounting for all state transition after interaction with precompilesEPSS 0.9%CVE-2026-39865MEDIUMAxios HTTP/2 Session Cleanup State Corruption VulnerabilityEPSS 0.7%CVE-2025-27104LOWdouble eval in For List Iter in VyperEPSS 0.4%CVE-2026-28789HIGHOliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handlingEPSS 0.4%CVE-2026-13489LOW78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronizationEPSS 0.2%CVE-2022-32643MEDIUMIn ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.2%CVE-2025-22853LOWImproper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege viaEPSS 0.1%CVE-2022-32642MEDIUMIn ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2022-32610MEDIUMIn vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2022-32609MEDIUMIn vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2022-32644MEDIUMIn vow, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2022-32648MEDIUMIn disp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution EPSS 0.1%CVE-2023-20611MEDIUMIn gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution pEPSS 0.1%CVE-2023-20610MEDIUMIn display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System EPSS 0.1%CVE-2023-20607MEDIUMIn ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System executioEPSS 0.1%CVE-2023-20625MEDIUMIn adsp, there is a possible double free due to a race condition. This could lead to local escalation of privilege with System execution priEPSS 0.1%