CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 39

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

1. 7.0CVE-2022-24525EPSS 0.4%2022-03-09

   Windows Update Stack Elevation of Privilege Vulnerability

2. 7.0CVE-2022-24505EPSS 0.4%2022-03-09

   Windows ALPC Elevation of Privilege Vulnerability

3. 7.0CVE-2022-23283EPSS 0.4%2022-03-09

   Windows ALPC Elevation of Privilege Vulnerability

4. 4.7CVE-2022-21975EPSS 0.5%2022-03-09

   Windows Hyper-V Denial of Service Vulnerability

5. 7.0CVE-2021-3640EPSS 0.4%2022-03-03

   A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls ioct UFFDIO_REGISTER or other way triggers race condition of the call sco_conn_del() together with the call sco_sock_sen…

6. 7.0CVE-2021-3609EPSS 0.4%2022-03-03

   .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the …

7. 7.8CVE-2022-24986EPSS 0.3%2022-02-26

   KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling t…

8. 3.1CVE-2022-0279EPSS 0.5%2022-02-21

   The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users

9. 4.7CVE-2021-20321EPSS 0.2%2022-02-18

   A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.

10. 7.2CVE-2020-25719EPSS 1.7%2022-02-18

    A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerbero…

11. 7.8CVE-2021-44731EPSS 1.0%2022-02-17

    A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private m…

12. 4.7CVE-2021-3753EPSS 0.4%2022-02-16

    A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from…

13. 7.1CVE-2021-3752EPSS 1.7%2022-02-16

    A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a race condition. This flaw allows a user to crash the system or escalate their priv…

14. 8.1CVE-2022-23639EPSS 1.2%2022-02-15

    crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the…

15. 5.9CVE-2022-24686EPSS 0.9%2022-02-14

    HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 1.1.11, and 1.2.5 artifact download functionality has a race condition such that the Nomad client agent could download the wrong artifact into the wrong destination. Fixed in 1.0.1…

16. 4.1CVE-2022-20032EPSS 0.1%2022-02-09

    In vow driver, there is a possible memory corruption due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS05852822;…

17. 4.7CVE-2021-40015EPSS 0.1%2022-02-09

    There is a race condition vulnerability in the binder driver subsystem in the kernel.Successful exploitation of this vulnerability may affect kernel stability.

18. 7.0CVE-2022-24114EPSS 0.2%2022-02-04

    Local privilege escalation due to race condition on application startup. The following products are affected: Acronis Cyber Protect Home Office (macOS) before build 39605, Acronis True Image 2021 (macOS) before build 39287

19. 4.7CVE-2021-34406EPSS 0.2%2022-01-18

    NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a system reboot.

20. 7.0CVE-2021-4083EPSS 0.3%2022-01-18

    A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a …

21. 7.0CVE-2021-39679EPSS 0.09%2022-01-14

    In init of vendor_graphicbuffer_meta.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for explo…

22. 7.0CVE-2021-39629EPSS 0.09%2022-01-14

    In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need…

23. 6.4CVE-2021-30313EPSS 0.1%2022-01-13

    Use after free condition can occur in wired connectivity due to a race condition while creating and deleting folders in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapd…

24. 7.0CVE-2022-21896EPSS 0.6%2022-01-11

    Windows DWM Core Library Elevation of Privilege Vulnerability

25. 7.0CVE-2022-21881EPSS 24%2022-01-11

    Windows Kernel Elevation of Privilege Vulnerability

26. 2.5CVE-2021-43566EPSS 0.4%2022-01-11

    All versions of Samba prior to 4.13.16 are vulnerable to a malicious client using an SMB1 or NFS race to allow a directory to be created in an area of the server file system not exported under the share definition. Note that SMB1 has to be…

27. 8.1CVE-2021-37134EPSS 0.5%2022-01-03

    Location-related APIs exists a Race Condition vulnerability.Successful exploitation of this vulnerability may use Higher Permissions for invoking the interface of location-related components.

28. 8.1CVE-2021-45710EPSS 1.2%2021-12-27

    An issue was discovered in the tokio crate before 1.8.4, and 1.9.x through 1.13.x before 1.13.1, for Rust. In certain circumstances involving a closed oneshot channel, there is a data race and memory corruption.

29. 8.1CVE-2021-45704EPSS 0.8%2021-12-27

    An issue was discovered in the metrics-util crate before 0.7.0 for Rust. There is a data race and memory corruption because AtomicBucket<T> unconditionally implements the Send and Sync traits.

30. 8.1CVE-2017-13905EPSS 0.9%2021-12-23

    A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be …

31. 7.0CVE-2021-44733EPSS 0.7%2021-12-22

    A use-after-free exists in drivers/tee/tee_shm.c in the TEE subsystem in the Linux kernel through 5.15.11. This occurs because of a race condition in tee_shm_get_from_id during an attempt to free a shared memory object.

32. 5.9CVE-2020-35216EPSS 0.7%2021-12-16

    An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.

33. 4.1CVE-2021-39648EPSS 0.2%2021-12-15

    In gadget_dev_desc_UDC_show of configfs.c, there is a possible disclosure of kernel heap memory due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not neede…

34. 6.4CVE-2021-39642EPSS 0.09%2021-12-15

    In synchronous_process_io_entries of lwis_ioctl.c, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed fo…

35. 7.0CVE-2021-0955EPSS 0.09%2021-12-15

    In pf_write_buf of FuseDaemon.cpp, there is possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitatio…

36. 6.4CVE-2021-0920KEVEPSS 0.9%2021-12-15

    In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Prod…

37. 4.3CVE-2021-43538EPSS 1.2%2021-12-08

    By misusing a race in our notification code, an attacker could have forcefully hidden the notification for pages that had received full screen and pointer lock access, which could have been used for spoofing attacks. This vulnerability aff…

38. 9.8CVE-2021-41025EPSS 1.5%2021-12-08

    Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using s…

39. 8.1CVE-2021-37074EPSS 0.7%2021-12-08

    There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user root privilege escalation.

40. 7.4CVE-2021-37069EPSS 0.6%2021-12-08

    There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to availability affected.

41. 5.9CVE-2021-37085EPSS 0.5%2021-12-07

    There is a Encoding timing vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to denial of service.

42. 5.9CVE-2021-37082EPSS 0.5%2021-12-07

    There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to motionhub crash.

43. 3.7CVE-2021-37073EPSS 0.4%2021-12-07

    There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the detection result is tampered with.

44. 7.0CVE-2021-44513EPSS 0.2%2021-12-07

    Insecure creation of temporary directories in tmate-ssh-server 2.3.0 allows a local attacker to compromise the integrity of session handling.

45. 7.0CVE-2020-12951EPSS 0.2%2021-11-16

    Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations.

46. 7.5CVE-2021-43411EPSS 1.3%2021-11-07

    An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is accessible through the ol…

47. 7.5CVE-2021-37991EPSS 0.8%2021-11-02

    Race in V8 in Google Chrome prior to 95.0.4638.54 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

48. 3.1CVE-2021-36181EPSS 0.4%2021-11-02

    A concurrent execution using shared resource with improper Synchronization vulnerability ('Race Condition') in the customer database interface of FortiPortal before 6.0.6 may allow an authenticated, low-privilege user to bring the underlyi…

49. 7.0CVE-2021-36808EPSS 0.3%2021-10-30

    A local attacker could bypass the app password using a race condition in Sophos Secure Workspace for Android before version 9.7.3115.

50. 3.7CVE-2021-36994EPSS 0.4%2021-10-28

    There is a issue that trustlist strings being repeatedly inserted into the linked list in Huawei Smartphone due to race conditions. Successful exploitation of this vulnerability can cause exceptions when managing the system trustlist.