CWE-362— Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.— MITRE CWE catalog

2,716 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-362page 49 of 55

CVE-2022-20097MEDIUMCVSS 4.7EG 4.7
2022-05-03
In aee daemon, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A…
CVE-2022-21975MEDIUMCVSS 4.7EG 4.7
2022-03-09
Windows Hyper-V Denial of Service Vulnerability
CVE-2021-20321MEDIUMCVSS 4.7EG 4.7
2022-02-18
A race condition accessing file object in the Linux kernel OverlayFS subsystem was found in the way users do rename in specific way with OverlayFS. A local user could use this flaw to crash the system.
CVE-2021-3753MEDIUMCVSS 4.7EG 4.7
2022-02-16
A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as the write access to vc_mode is not protected by lock-in vt_ioctl (KDSETMDE). The highest threat from…
CVE-2021-40015MEDIUMCVSS 4.7EG 4.7
2022-02-09
There is a race condition vulnerability in the binder driver subsystem in the kernel.Successful exploitation of this vulnerability may affect kernel stability.
CVE-2021-34406MEDIUMCVSS 4.7EG 4.7
2022-01-18
NVIDIA Tegra kernel driver contains a vulnerability in NVHost, where a specific race condition can lead to a null pointer dereference, which may lead to a system reboot.
CVE-2021-0298MEDIUMCVSS 4.7EG 4.7
2021-10-19
A Race Condition in the 'show chassis pic' command in Juniper Networks Junos OS Evolved may allow an attacker to crash the port interface concentrator daemon (picd) process on the FPC, if the command is executed coincident with other syste…
CVE-2021-0443MEDIUMCVSS 4.7EG 4.7
2021-04-13
In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due to a race condition. This could lead to local information disclosure across user profiles with no additional execution pr…
CVE-2021-29265MEDIUMCVSS 4.7EG 4.7
2021-03-26
An issue was discovered in the Linux kernel before 5.11.7. usbip_sockfd_store in drivers/usb/usbip/stub_dev.c allows attackers to cause a denial of service (GPF) because the stub-up sequence has race conditions during an update of the loca…
CVE-2021-28964MEDIUMCVSS 4.7EG 4.7
2021-03-22
A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka…
CVE-2020-35451MEDIUMCVSS 4.7EG 4.7
2021-03-09
There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.
CVE-2020-36203MEDIUMCVSS 4.7EG 4.7
2021-01-26
An issue was discovered in the reffers crate through 2020-12-01 for Rust. ARefss can contain a !Send,!Sync object, leading to a data race and memory corruption.
CVE-2021-0320MEDIUMCVSS 4.7EG 4.7
2021-01-11
In is_device_locked and set_device_locked of keystore_keymaster_enforcement.h, there is a possible bypass of lockscreen requirements for keyguard bound keys due to a race condition. This could lead to local information disclosure with no a…
CVE-2020-35897MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the atom crate before 0.3.6 for Rust. An unsafe Send implementation allows a cross-thread data race.
CVE-2020-35886MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the arr crate through 2020-08-25 for Rust. An attacker can smuggle non-Sync/Send types across a thread boundary to cause a data race.
CVE-2020-35928MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the concread crate before 0.2.6 for Rust. Attackers can cause an ARCache<K,V> data race by sending types that do not implement Send/Sync.
CVE-2020-35914MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockWriteGuard unsoundness.
CVE-2020-35913MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
CVE-2020-35912MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
CVE-2020-35911MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness.
CVE-2020-35905MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).
CVE-2020-29372MEDIUMCVSS 4.7EG 4.7
2020-11-28
An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.
CVE-2020-27675MEDIUMCVSS 4.7EG 4.7
2020-10-22
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or…
CVE-2020-25604MEDIUMCVSS 4.7EG 4.7
2020-09-23
An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same gu…
CVE-2020-0373MEDIUMCVSS 4.7EG 4.7
2020-09-17
In SoundTriggerHwService, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produ…
CVE-2020-4387MEDIUMCVSS 4.7EG 4.7
2020-07-01
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269.
CVE-2020-4386MEDIUMCVSS 4.7EG 4.7
2020-07-01
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179268.
CVE-2020-5967MEDIUMCVSS 4.7EG 4.7
2020-06-25
NVIDIA Linux GPU Display Driver, all versions, contains a vulnerability in the UVM driver, in which a race condition may lead to a denial of service.
CVE-2020-12114MEDIUMCVSS 4.7EG 4.7
2020-05-04
A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by cor…
CVE-2020-0568MEDIUMCVSS 4.7EG 4.7
2020-04-15
Race condition in the Intel(R) Driver and Support Assistant before version 20.1.5 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2020-0008MEDIUMCVSS 4.7EG 4.7
2020-01-08
In LowEnergyClient::MtuChangedCallback of low_energy_client.cc, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interactio…
CVE-2011-3585MEDIUMCVSS 4.7EG 4.7
2019-12-31
Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.
CVE-2019-19965MEDIUMCVSS 4.7EG 4.7
2019-12-25
In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.
CVE-2019-2219MEDIUMCVSS 4.7EG 4.7
2019-12-06
In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background without notification to the user due to a permission bypass. This could lead to local escalation of priv…
CVE-2014-5254MEDIUMCVSS 4.7EG 4.7
2019-11-21
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.
CVE-2019-16354MEDIUMCVSS 4.7EG 4.7
2019-09-16
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
CVE-2019-14694MEDIUMCVSS 4.7EG 4.7
2019-08-28
A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications.…
CVE-2019-0114MEDIUMCVSS 4.7EG 4.7
2019-05-17
A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.
CVE-2019-11190MEDIUMCVSS 4.7EG 4.7
2019-04-12
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race c…
CVE-2016-10741MEDIUMCVSS 4.7EG 4.7
2019-02-01
In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON …
CVE-2018-19489MEDIUMCVSS 4.7EG 4.7
2018-12-13
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
CVE-2017-18302MEDIUMCVSS 4.7EG 4.7
2018-09-20
In Snapdragon (Automobile ,Mobile) in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, a crafted HLOS c…
CVE-2018-15499MEDIUMCVSS 4.7EG 4.7
2018-08-24
GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Condition and BSoD on Windows) by not checking that user-mode memory is available right before writing to it. A check is onl…
CVE-2018-14329MEDIUMCVSS 4.7EG 4.7
2018-07-17
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.
CVE-2018-4092MEDIUMCVSS 4.7EG 4.7
2018-04-03
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. A race conditi…
CVE-2017-9691MEDIUMCVSS 4.7EG 4.7
2018-03-30
There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver.
CVE-2017-18224MEDIUMCVSS 4.7EG 4.7
2018-03-12
In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allows local users to cause a denial of service (BUG…
CVE-2018-7995MEDIUMCVSS 4.7EG 4.7
2018-03-09
Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval…
CVE-2017-18203MEDIUMCVSS 4.7EG 4.7
2018-02-27
The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.
CVE-2017-8148MEDIUMCVSS 4.7EG 4.7
2017-11-22
Audio driver in P9 smartphones with software The versions before EVA-AL10C00B389 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and the race condition caus…

Map vulnerabilities like CWE-362 to your infrastructure

EchelonGraph correlates every CVE — across CWE-362 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →