cve.bz

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition), page 46

Filter

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

What the weakness is: CWE-362 at MITRE

Ask an AI about CWE-362

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/362.html and https://cve.bz/cve/cwe/362?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2019-6232EPSS 1.2%

    A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iTunes installer in an untrusted directory may result in a…

  2. 5.9CVE-2019-16779EPSS 1.7%

    In RubyGem excon before 0.71.0, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returni…

  3. 5.9CVE-2019-18827EPSS 1.4%

    On Barco ClickShare Button R9861500D01 devices (before firmware version 1.9.0) JTAG access is disabled after ROM code execution. This means that JTAG access is possible when the system is running code from ROM before handing control over t…

  4. 8.1CVE-2014-3701EPSS 1.5%

    eDeploy has tmp file race condition flaws

  5. 6.6CVE-2019-19580EPSS 1.2%

    An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations, because of an incomplete fix for CVE-2019-18421. XSA-299 …

  6. 4.7CVE-2019-2219EPSS 0.1%

    In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background without notification to the user due to a permission bypass. This could lead to local escalation of priv…

  7. 4.2CVE-2019-19537EPSS 0.3%

    In the Linux kernel before 5.2.10, there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer, aka CID-303911cfc5b9. This affects drivers/usb/core/file.c.

  8. 8.1CVE-2019-19017EPSS 1.1%

    An issue was discovered in TitanHQ WebTitan before 5.18. The appliance has a hard-coded root password set during installation. An attacker could utilize this to gain root privileges on the system.

  9. 7.0CVE-2014-5255EPSS 0.4%

    xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254.

  10. 4.7CVE-2014-5254EPSS 0.3%

    xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.

  11. 4.4CVE-2016-1000236EPSS 0.9%

    Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.

  12. 7.4CVE-2019-2213EPSS 0.1%

    In binder_free_transaction of binder.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit…

  13. 7.8CVE-2019-5228EPSS 0.6%

    Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E2…

  14. 7.0CVE-2019-1416EPSS 0.5%

    An elevation of privilege vulnerability exists due to a race condition in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'.

  15. 8.1CVE-2009-4011EPSS 1.0%

    dtc-xen 0.5.x before 0.5.4 suffers from a race condition where an attacker could potentially get a bash access as xenXX user on the dom0, and then access a potentially reuse an already opened VPS console.

  16. 8.1CVE-2019-10529ExploitEPSS 1.7%

    Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function set_page_dirty() in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Io…

  17. 8.1CVE-2006-4245EPSS 0.9%

    archivemail 0.6.2 uses temporary files insecurely leading to a possible race condition.

  18. 6.6CVE-2019-8232EPSS 0.9%

    In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through…

  19. 7.0CVE-2019-18684EPSS 0.3%

    Sudo through 1.8.29 allows local users to escalate to root if they have write access to file descriptor 3 of the sudo process. This occurs because of a race condition between determining a uid, and the setresuid and openat system calls. Th…

  20. 7.0CVE-2019-18683EPSS 1.0%

    An issue was discovered in drivers/media/platform/vivid in the Linux kernel through 5.3.8. It is exploitable for privilege escalation on some Linux distributions where local users have /dev/video0 access, but only if the driver happens to …

  21. 8.1CVE-2005-2352EPSS 0.8%

    I race condition in Temp files was found in gs-gpl before 8.56 addons scripts.

  22. 7.5CVE-2019-18421EPSS 1.7%

    An issue was discovered in Xen through 4.12.x allowing x86 PV guest OS users to gain host OS privileges by leveraging race conditions in pagetable promotion and demotion operations. There are issues with restartable PV type change operatio…

  23. 8.1CVE-2019-8162EPSS 2.3%

    Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a race condition vulnerability. Successful exploitation…

  24. 5.9CVE-2019-14810EPSS 0.7%

    A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer potentially allowing the possibility of …

  25. 5.9CVE-2019-6471EPSS 3.3%

    A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all relea…

  26. 7.0CVE-2019-17342EPSS 0.3%

    An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a race condition that arose when XENMEM_exchange was introduced.

  27. 7.8CVE-2019-17341EPSS 0.3%

    An issue was discovered in Xen through 4.11.x allowing x86 PV guest OS users to cause a denial of service or gain privileges by leveraging a page-writability race condition during addition of a passed-through PCI device.

  28. 7.0CVE-2019-2284EPSS 0.1%

    Possible use-after-free issue due to a race condition while calling camera ioctl concurrently in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in M…

  29. 6.4CVE-2019-9375EPSS 0.1%

    In hostapd, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersion…

  30. 6.4CVE-2019-2189EPSS 0.1%

    In the Easel driver, there is possible memory corruption due to race conditions. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers…

  31. 6.4CVE-2019-2188EPSS 0.1%

    In the Easel driver, there is possible memory corruption due to race conditions. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers…

  32. 7.0CVE-2019-11736EPSS 0.2%

    The Mozilla Maintenance Service does not guard against files being hardlinked to another file in the updates directory, allowing for the replacement of local files, including the Maintenance Service executable, which is run with privileged…

  33. 4.8CVE-2019-11184EPSS 0.8%

    A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated user to potentially enable partial information disclosure via adjacent access.

  34. 4.7CVE-2019-16354EPSS 0.2%

    The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.

  35. 5.3CVE-2019-11546EPSS 0.6%

    An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially …

  36. 7.0CVE-2019-9458EPSS 0.2%

    In the Android kernel in the video driver there is a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  37. 6.4CVE-2019-9450EPSS 0.1%

    In the Android kernel in the FingerTipS touchscreen driver there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not nee…

  38. 6.4CVE-2019-9271EPSS 0.1%

    In the Android kernel in the mnh driver there is a race condition due to insufficient locking. This could lead to a use-after-free which could lead to escalation of privilege with System execution privileges needed. User interaction is not…

  39. 7.5CVE-2019-5612EPSS 0.9%

    In FreeBSD 12.0-STABLE before r351264, 12.0-RELEASE before 12.0-RELEASE-p10, 11.3-STABLE before r351265, 11.3-RELEASE before 11.3-RELEASE-p3, and 11.2-RELEASE before 11.2-RELEASE-p14, the kernel driver for /dev/midistat implements a read h…

  40. 4.7CVE-2019-14694EPSS 0.4%

    A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications.…

  41. 7.0CVE-2019-2121EPSS 0.1%

    In ActivityManagerService.attachApplication of ActivityManagerService, there is a possible race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for …

  42. 7.0CVE-2016-10906EPSS 0.4%

    An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.

  43. 7.8CVE-2019-3744EPSS 0.4%

    Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software packag…

  44. 8.1CVE-2019-12263EPSS 3.2%

    Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.

  45. 6.8CVE-2016-10798EPSS 0.5%

    cPanel before 58.0.4 allows a file-ownership change (to nobody) via rearrangeacct (SEC-134).

  46. 3.3CVE-2018-20940EPSS 0.3%

    cPanel before 68.0.27 allows attackers to read root's crontab file during a short time interval upon the enabling of backups (SEC-342).

  47. 5.9CVE-2019-7614EPSS 1.0%

    A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to respons…

  48. 8.1CVE-2019-11922EPSS 1.4%

    A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.

  49. 7.0CVE-2019-2345EPSS 0.1%

    Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, SD 425, SD 42…

  50. 7.0CVE-2019-2314EPSS 0.1%

    Possible race condition that will cause a use-after-free when writing to two sysfs entries at nearly the same time in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snap…