Falhas do tipo CWE-667

151 resultados

Sincronização inadequada ou ausente

Ocorre quando código compartilhado por múltiplas threads não usa mecanismos de lock (mutex, semáforo, etc.) para proteger acessos concorrentes a dados. Sem sincronização, dois threads podem ler e escrever o mesmo recurso simultaneamente, causando corrupção de dados, decisões de segurança incorretas ou comportamento imprevisível.

Exemplo

Um contador de tentativas de login compartilhado entre requisições HTTP sem lock: dois requests simultâneos leem o valor 4, incrementam para 5 e escrevem de volta. Resultado: o contador fica 5 em vez de 6, e um atacante consegue mais tentativas que o permitido.

Como mitigar

Use primitivas de sincronização nativa da linguagem (mutex em C/C++, synchronized em Java, Lock em Python) ao acessar dados compartilhados. Se possível, prefira estruturas thread-safe (ConcurrentHashMap, AtomicInteger) ou evite compartilhamento redesenhando a arquitetura (thread-local storage, message passing).

CVE-2021-47242HIGHmptcp: fix soft lookup in subflow_error_report()EPSS 0.3%CVE-2025-21900HIGHNFSv4: Fix a deadlock when recovering state on a sillyrenamed fileEPSS 0.3%CVE-2023-44119—Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.EPSS 0.3%CVE-2021-43395MEDIUMAn issue was discovered in illumos before f859e7171bb5db34321e45585839c6c3200ebb90, OmniOS Community Edition r151038, OpenIndiana Hipster 20EPSS 0.3%CVE-2022-3303MEDIUMA race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference whiEPSS 0.3%CVE-2026-21914HIGHJunos OS: SRX Series: A specifically malformed GTP message will cause an FPC crashEPSS 0.3%CVE-2025-21809HIGHrxrpc, afs: Fix peer hash locking vs RCU callbackEPSS 0.3%CVE-2005-3106MEDIUMRace condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), might allow local users EPSS 0.3%CVE-2023-2612MEDIUMshiftfs lock unbalance in Ubuntu-specific kernelsEPSS 0.3%CVE-2024-45818MEDIUMDeadlock in x86 HVM standard VGA handlingEPSS 0.3%CVE-2009-2857MEDIUMThe kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between the filesystem and virtEPSS 0.3%CVE-2021-4147—A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on the host to deadlock EPSS 0.2%CVE-2022-49441MEDIUMtty: fix deadlock caused by calling printk() under tty_port->lockEPSS 0.2%CVE-2021-41213MEDIUMDeadlock in mutually recursive `tf.function` objectsEPSS 0.2%CVE-2021-22530HIGHImproper account management vulnerability in NetIQ Advance AuthenticationEPSS 0.2%CVE-2026-62426HIGHsysctl and platform-op locks open to abuseEPSS 0.2%CVE-2024-56531HIGHALSA: caiaq: Use snd_card_free_when_closed() at disconnectionEPSS 0.2%CVE-2025-49178MEDIUMXorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignoreEPSS 0.2%CVE-2025-14345LOWCross-Shard Failovers May Lead to Partial Transaction Commit in MongoDB ServerEPSS 0.2%CVE-2025-10151HIGHMalicious TCP/IP thread locking leads into diverse malfunctionsEPSS 0.2%