cve.bz

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 32

Filter

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

Ask an AI about CWE-362

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/362.html and https://cve.bz/cve/cwe/362?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.3CVE-2023-3397EPSS 0.2%

    A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attacker with normal user privileges to crash the system or leak internal kernel info…

  2. 6.4CVE-2023-35645EPSS 0.07%

    In tbd of tbd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

  3. 8.1CVE-2023-41774EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  4. 8.1CVE-2023-41773EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  5. 8.1CVE-2023-41771EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  6. 8.1CVE-2023-41770EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  7. 8.1CVE-2023-41769EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  8. 8.1CVE-2023-41768EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  9. 8.1CVE-2023-41767EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  10. 8.1CVE-2023-41765EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  11. 8.1CVE-2023-38166EPSS 1.3%

    Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

  12. 7.0CVE-2023-38159EPSS 4.1%

    Windows Graphics Component Elevation of Privilege Vulnerability

  13. 7.0CVE-2023-36902EPSS 0.5%

    Windows Runtime Remote Code Execution Vulnerability

  14. 7.0CVE-2023-36776EPSS 2.1%

    Win32k Elevation of Privilege Vulnerability

  15. 4.4CVE-2023-36698EPSS 0.5%

    Windows Kernel Security Feature Bypass Vulnerability

  16. 5.0CVE-2023-38538EPSS 0.2%

    A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.

  17. 5.6CVE-2023-38537EPSS 0.3%

    A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video calls that could have resulted in app termination or unexpected control flow with very low probability.

  18. 4.7CVE-2023-4732EPSS 0.2%

    A flaw was found in pfn_swap_entry_to_page in memory management subsystem in the Linux Kernel. In this flaw, an attacker with a local user privilege may cause a denial of service problem due to a BUG statement referencing pmd_t x.

  19. 3.7CVE-2023-5313EPSS 0.6%

    A vulnerability classified as problematic was found in phpkobo Ajax Poll Script 3.18. Affected by this vulnerability is an unknown functionality of the file ajax-poll.php of the component Poll Handler. The manipulation leads to improper en…

  20. 4.7CVE-2023-42756EPSS 0.3%

    A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local us…

  21. 4.7CVE-2023-41979EPSS 0.2%

    A race condition was addressed with improved locking. This issue is fixed in macOS Sonoma 14. An app may be able to modify protected parts of the file system.

  22. 3.7CVE-2023-41306EPSS 0.4%

    Vulnerability of mutex management in the bone voice ID trusted application (TA) module. Successful exploitation of this vulnerability may cause the bone voice ID feature to be unavailable.

  23. 5.6CVE-2023-3301EPSS 0.3%

    A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an asse…

  24. 8.1CVE-2023-41915EPSS 1.2%

    OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0.

  25. 7.0CVE-2023-38616EPSS 0.2%

    A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13.5. An app may be able to execute arbitrary code with kernel privileges.

  26. 6.4CVE-2023-20835EPSS 0.07%

    In camsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07341261; Issue…

  27. 6.4CVE-2023-20834EPSS 0.07%

    In pda, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608514; Issue ID…

  28. 6.4CVE-2023-20827EPSS 0.07%

    In ims service, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0793710…

  29. 5.9CVE-2022-48566EPSS 1.3%

    An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.

  30. 5.5CVE-2023-21290EPSS 0.07%

    In update of MmsProvider.java, there is a possible way to bypass file permission checks due to a race condition. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for …

  31. 7.8CVE-2023-34438EPSS 0.1%

    Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

  32. 6.4CVE-2023-34349EPSS 0.1%

    Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access.

  33. 4.7CVE-2023-22276EPSS 0.1%

    Race condition in firmware for some Intel(R) Ethernet Controllers and Adapters E810 Series before version 1.7.2.4 may allow an authenticated user to potentially enable denial of service via local access.

  34. 7.0CVE-2023-35378EPSS 0.4%

    Windows Projected File System Elevation of Privilege Vulnerability

  35. 6.4CVE-2023-20801EPSS 0.07%

    In imgsys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07420968; Issue…

  36. 5.9CVE-2023-4049EPSS 0.6%

    Race conditions in reference counting code were found through code inspection. These could have resulted in potentially exploitable use-after-free vulnerabilities. This vulnerability affects Firefox < 116, Firefox ESR < 102.14, and Firefox…

  37. 3.1CVE-2023-37904EPSS 0.3%

    Discourse is an open source discussion platform. Prior to version 3.0.6 of the `stable` branch and version 3.1.0.beta7 of the `beta` and `tests-passed` branches, more users than permitted could be created from invite links. The issue is pa…

  38. 5.3CVE-2023-33951EPSS 0.3%

    A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a loca…

  39. 8.1CVE-2023-32258EPSS 2.5%

    A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing…

  40. 8.1CVE-2023-32257EPSS 2.4%

    A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP and SMB2_LOGOFF commands. The issue results from the lack of proper locking when pe…

  41. 5.5CVE-2023-38409EPSS 0.2%

    An issue was discovered in set_con2fb_map in drivers/video/fbdev/core/fbcon.c in the Linux kernel before 6.2.12. Because an assignment occurs only for the first vc, the fbcon_registered_fb and fbcon_display arrays can be desynchronized in …

  42. 3.1CVE-2023-21262EPSS 0.1%

    In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a race condition. This could lead to false user expectations. User interaction is needed for exploitat…

  43. 4.1CVE-2022-48451EPSS 0.07%

    In bluetooth service, there is a possible out of bounds write due to race condition. This could lead to local denial of service with System execution privileges needed.

  44. 7.5CVE-2023-36884KEVEPSS 99.4%

    Windows Search Remote Code Execution Vulnerability

  45. 7.8CVE-2023-35362EPSS 0.3%

    Windows Clip Service Elevation of Privilege Vulnerability

  46. 7.0CVE-2023-35361EPSS 0.3%

    Windows Kernel Elevation of Privilege Vulnerability

  47. 7.0CVE-2023-35360EPSS 0.3%

    Windows Kernel Elevation of Privilege Vulnerability

  48. 6.6CVE-2023-35351EPSS 0.7%

    Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability

  49. 6.6CVE-2023-35346EPSS 0.7%

    Windows DNS Server Remote Code Execution Vulnerability

  50. 6.6CVE-2023-35310EPSS 0.7%

    Windows DNS Server Remote Code Execution Vulnerability