cve.bz

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 33

Filter

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

Ask an AI about CWE-362

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/362.html and https://cve.bz/cve/cwe/362?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-35309EPSS 0.8%

    Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  2. 8.1CVE-2023-33170EPSS 2.0%

    ASP.NET and Visual Studio Security Feature Bypass Vulnerability

  3. 4.7CVE-2023-3108EPSS 0.2%

    A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system.

  4. 5.3CVE-2023-1672EPSS 0.6%

    A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.

  5. 8.1CVE-2023-32254EPSS 2.9%

    A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing opera…

  6. 8.1CVE-2023-32250EPSS 2.6%

    A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operati…

  7. 5.9CVE-2022-48509EPSS 0.3%

    Race condition vulnerability due to multi-thread access to mutually exclusive resources in Huawei Share. Successful exploitation of this vulnerability may cause the program to exit abnormally.

  8. 5.3CVE-2023-35863EPSS 0.3%

    In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before th…

  9. 3.1CVE-2023-2010EPSS 0.4%

    The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times …

  10. 6.4CVE-2023-20771EPSS 0.08%

    In display, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07671046; I…

  11. 4.1CVE-2023-21178EPSS 0.05%

    In installKey of KeyUtil.cpp, there is a possible failure of file encryption due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.…

  12. 7.0CVE-2023-32413EPSS 0.5%

    A race condition was addressed with improved state handling. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may…

  13. 7.0CVE-2023-35829EPSS 0.4%

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in rkvdec_remove in drivers/staging/media/rkvdec/rkvdec.c.

  14. 7.0CVE-2023-35828EPSS 0.5%

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in renesas_usb3_remove in drivers/usb/gadget/udc/renesas_usb3.c.

  15. 7.0CVE-2023-35827EPSS 0.2%

    An issue was discovered in the Linux kernel through 6.3.8. A use-after-free was found in ravb_remove in drivers/net/ethernet/renesas/ravb_main.c.

  16. 7.0CVE-2023-35826EPSS 0.2%

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in cedrus_remove in drivers/staging/media/sunxi/cedrus/cedrus.c.

  17. 7.0CVE-2023-35824EPSS 0.2%

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in dm1105_remove in drivers/media/pci/dm1105/dm1105.c.

  18. 7.0CVE-2023-35823EPSS 0.2%

    An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134_finidev in drivers/media/pci/saa7134/saa7134-core.c.

  19. 7.0CVE-2023-21101EPSS 0.07%

    In multiple functions of WVDrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

  20. 4.7CVE-2023-21095EPSS 0.06%

    In canStartSystemGesture of RecentsAnimationDeviceState.java, there is a possible partial lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User inte…

  21. 7.8CVE-2022-31645EPSS 0.2%

    Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.

  22. 4.1CVE-2023-20750EPSS 0.07%

    In swpm, there is a possible out of bounds write due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780926; Iss…

  23. 6.4CVE-2023-20736EPSS 0.07%

    In vcu, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Iss…

  24. 7.5CVE-2023-29537EPSS 0.6%

    Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.

  25. 5.9CVE-2023-33974EPSS 0.7%

    RIOT-OS, an operating system for Internet of Things (IoT) devices, contains a network stack with the ability to process 6LoWPAN frames. In versions 2023.01 and prior, an attacker can send multiple crafted frames to the device to trigger a …

  26. 5.3CVE-2023-30571EPSS 0.2%

    Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_write_disk_posix.c changes the umask of the whole process for a very short period of time; a race condition with another thr…

  27. 4.7CVE-2023-2898EPSS 0.2%

    There is a null-pointer-dereference flaw found in f2fs_write_end_io in fs/f2fs/data.c in the Linux kernel. This flaw allows a local privileged user to cause a denial of service problem.

  28. 5.9CVE-2023-28320EPSS 2.7%

    A denial of service vulnerability exists in curl <v8.1.0 in the way libcurl provides several different backends for resolving host names, selected at build time. If it is built to use the synchronous resolver, it allows name resolves to ti…

  29. 3.3CVE-2023-31225EPSS 0.1%

    The Gallery app has the risk of hijacking attacks. Successful exploitation of this vulnerability may cause download failures and affect product availability.

  30. 6.4CVE-2023-33203EPSS 0.4%

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/emac.c if a physically proximate attacker unplugs an emac based device.

  31. 5.9CVE-2023-32570EPSS 0.8%

    VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_decode_frame_exit.

  32. 5.9CVE-2023-28126EPSS 67%

    An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.

  33. 5.9CVE-2023-28125EPSS 2.3%

    An improper authentication vulnerability exists in Avalanche Premise versions 6.3.x and below that could allow an attacker to gain access to the server by registering to receive messages from the server and perform an authentication bypass.

  34. 8.1CVE-2023-24903EPSS 0.9%

    Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

  35. 7.0CVE-2023-24899EPSS 0.3%

    Windows Graphics Component Elevation of Privilege Vulnerability

  36. 9.8CVE-2023-28201EPSS 1.2%

    This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.4 and iPadOS 15.7.4, tvOS 16.4. A remote user may be able to cause unexpected app terminati…

  37. 4.7CVE-2023-27952EPSS 0.2%

    A race condition was addressed with improved locking. This issue is fixed in macOS Ventura 13.3. An app may bypass Gatekeeper checks.

  38. 8.1CVE-2023-21712EPSS 1.0%

    Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

  39. 7.0CVE-2023-2006EPSS 0.4%

    A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to esca…

  40. 4.7CVE-2023-31083EPSS 0.3%

    An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL point…

  41. 7.0CVE-2023-28142EPSS 0.1%

    A Race Condition exists in the Qualys Cloud Agent for Windows platform in versions from 3.1.3.34 and before 4.5.3.1. This allows attackers to escalate privileges limited on the local machine during uninstallation of the Qualys Cloud Agent …

  42. 5.7CVE-2023-30543EPSS 0.4%

    @web3-react is a framework for building Ethereum Apps . In affected versions the `chainId` may be outdated if the user changes chains as part of the connection flow. This means that the value of `chainId` returned by `useWeb3React()` may b…

  43. 5.3CVE-2023-28984EPSS 0.2%

    A Use After Free vulnerability in the Layer 2 Address Learning Manager (l2alm) of Juniper Networks Junos OS on QFX Series allows an adjacent attacker to cause the Packet Forwarding Engine to crash and restart, leading to a Denial of Servic…

  44. 7.0CVE-2023-26980EPSS 0.3%

    PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software and force the OS to boot directly to Android during the boot process. NOTE: the vendor disputes this…

  45. 5.9CVE-2023-1285EPSS 0.7%

    Signal Handler Race Condition vulnerability in Mitsubishi Electric India GC-ENET-COM whose first 2 digits of 11-digit serial number of unit are "16" allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition in E…

  46. 6.6CVE-2023-28308EPSS 0.9%

    Windows DNS Server Remote Code Execution Vulnerability

  47. 6.6CVE-2023-28307EPSS 0.9%

    Windows DNS Server Remote Code Execution Vulnerability

  48. 6.6CVE-2023-28306EPSS 0.9%

    Windows DNS Server Remote Code Execution Vulnerability

  49. 6.6CVE-2023-28305EPSS 0.9%

    Windows DNS Server Remote Code Execution Vulnerability

  50. 6.6CVE-2023-28278EPSS 0.9%

    Windows DNS Server Remote Code Execution Vulnerability