CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2922 vulnerabilities reference this CWE, most recent first.
GHSA-7P3H-GFR2-RWCV
Vulnerability from github – Published: 2026-02-04 18:30 – Updated: 2026-07-14 15:31In the Linux kernel, the following vulnerability has been resolved:
scsi: core: Wake up the error handler when final completions race against each other
The fragile ordering between marking commands completed or failed so that the error handler only wakes when the last running command completes or times out has race conditions. These race conditions can cause the SCSI layer to fail to wake the error handler, leaving I/O through the SCSI host stuck as the error state cannot advance.
First, there is an memory ordering issue within scsi_dec_host_busy(). The write which clears SCMD_STATE_INFLIGHT may be reordered with reads counting in scsi_host_busy(). While the local CPU will see its own write, reordering can allow other CPUs in scsi_dec_host_busy() or scsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to see a host busy equal to the host_failed count.
This race condition can be prevented with a memory barrier on the error path to force the write to be visible before counting host busy commands.
Second, there is a general ordering issue with scsi_eh_inc_host_failed(). By counting busy commands before incrementing host_failed, it can race with a final command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does not see host_failed incremented but scsi_eh_inc_host_failed() counts busy commands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(), resulting in neither waking the error handler task.
This needs the call to scsi_host_busy() to be moved after host_failed is incremented to close the race condition.
{
"affected": [],
"aliases": [
"CVE-2026-23110"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-04T17:16:21Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: core: Wake up the error handler when final completions race against each other\n\nThe fragile ordering between marking commands completed or failed so\nthat the error handler only wakes when the last running command\ncompletes or times out has race conditions. These race conditions can\ncause the SCSI layer to fail to wake the error handler, leaving I/O\nthrough the SCSI host stuck as the error state cannot advance.\n\nFirst, there is an memory ordering issue within scsi_dec_host_busy().\nThe write which clears SCMD_STATE_INFLIGHT may be reordered with reads\ncounting in scsi_host_busy(). While the local CPU will see its own\nwrite, reordering can allow other CPUs in scsi_dec_host_busy() or\nscsi_eh_inc_host_failed() to see a raised busy count, causing no CPU to\nsee a host busy equal to the host_failed count.\n\nThis race condition can be prevented with a memory barrier on the error\npath to force the write to be visible before counting host busy\ncommands.\n\nSecond, there is a general ordering issue with scsi_eh_inc_host_failed(). By\ncounting busy commands before incrementing host_failed, it can race with a\nfinal command in scsi_dec_host_busy(), such that scsi_dec_host_busy() does\nnot see host_failed incremented but scsi_eh_inc_host_failed() counts busy\ncommands before SCMD_STATE_INFLIGHT is cleared by scsi_dec_host_busy(),\nresulting in neither waking the error handler task.\n\nThis needs the call to scsi_host_busy() to be moved after host_failed is\nincremented to close the race condition.",
"id": "GHSA-7p3h-gfr2-rwcv",
"modified": "2026-07-14T15:31:39Z",
"published": "2026-02-04T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23110"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/219f009ebfd1ef3970888ee9eef4c8a06357f862"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48cbc304c5ea796421f7d10b7798fa581970c080"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/64ae21b9c4f0c7e60cf47a53fa7ab68852079ef0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6d9a367be356101963c249ebf10ea10b32886607"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9fdc6f28d5e81350ab1d2cac8389062bd09e61e1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cc872e35c0df80062abc71268d690a2f749e542e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fe2f8ad6f0999db3b318359a01ee0108c703a8c3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7P5M-XRH7-769R
Vulnerability from github – Published: 2026-03-16 16:43 – Updated: 2026-03-19 21:11Summary
Assumed repo path is /Users/zwique/Downloads/SandboxJS-0.8.34 (no /Users/zwique/Downloads/SandboxJS found). A global tick state (currentTicks.current) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox's tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite currentTicks.current between scheduling and execution, causing the timer callback to run under a different sandbox's tick budget and bypass the original sandbox's execution quota/watchdog.
Impact: execution quota bypass → CPU/resource abuse
Details
- Affected project: SandboxJS (owner: nyariv)
- Assumed checked-out version:
SandboxJS-0.8.34at/Users/zwique/Downloads/SandboxJS-0.8.34
Vulnerable code paths
-
/src/eval.ts—sandboxFunctionbindsticksusingticks || currentTicks.current:createFunction(..., ticks || currentTicks.current, { ...context, ... })Relevant lines: 44, 53, 164, 167. -
/src/evaluator.ts//src/executor.ts— global ticks:export const currentTicks = { current: { ticks: BigInt(0) } as Ticks };and_execNoneRecurse(...) { currentTicks.current = ticks; ... }Relevant lines: ~1700, 1712. -
sandboxedSetTimeoutcompiles string handlers at execution time, not at scheduling time, which letscurrentTicks.currentbe the wrong sandbox's ticks when compilation occurs.
Why This Is Vulnerable
currentTicks.currentis global mutable state shared across all sandbox instances.- Timer string handlers are compiled at the moment the timer fires and read
currentTicks.currentat that time. If another sandbox runs between scheduling and execution, it can replacecurrentTicks.current. The scheduled timer's code will be compiled/executed with the other sandbox's tick budget. This allows the original sandbox's execution quota to be bypassed.
Proof of Concept
Run with Node.js; adjust path if needed.
// PoC (run with node); adjust path if needed
import Sandbox from '/Users/zwique/Downloads/SandboxJS-0.8.34/node_modules/@nyariv/sandboxjs/build/Sandbox.js';
const globals = { ...Sandbox.SAFE_GLOBALS, setTimeout, clearTimeout };
const prototypeWhitelist = Sandbox.SAFE_PROTOTYPES;
const sandboxA = new Sandbox({
globals,
prototypeWhitelist,
executionQuota: 50n,
haltOnSandboxError: true,
});
let haltedA = false;
sandboxA.subscribeHalt(() => { haltedA = true; });
const sandboxB = new Sandbox({ globals, prototypeWhitelist });
// Sandbox A schedules a heavy string handler
sandboxA.compile(
'setTimeout("let x=0; for (let i=0;i<200;i++){ x += i } globalThis.doneA = true;", 0);'
)().run();
// Run sandbox B before A's timer fires
sandboxB.compile('1+1')().run();
setTimeout(() => {
console.log({ haltedA, doneA: sandboxA.context.sandboxGlobal.doneA });
}, 50);
Reproduction Steps
-
Place the PoC in
hi.jsand run:node /Users/zwique/Downloads/SandboxJS-0.8.34/hi.js -
Observe output similar to:
{ haltedA: false, doneA: true }This indicates the heavy loop completed and the quota was bypassed. -
Remove the
sandboxB.compile('1+1')().run();line and rerun. Output should now be:{ haltedA: true }This indicates quota enforcement is working correctly.
Impact
- Type: Runtime guard bypass (execution-quota / watchdog bypass)
- Who is impacted: Applications that run multiple SandboxJS instances concurrently in the same process — multi-tenant interpreters, plugin engines, server-side scripting hosts, online code runners.
- Practical impact: Attackers controlling sandboxed code can bypass configured execution quotas/watchdog and perform CPU-intensive loops or long-running computation, enabling resource exhaustion/DoS or denial of service against the host process or other tenants.
- Does not (as tested) lead to: Host object exposure or direct sandbox escape (no
process/requireleakage observed from this primitive alone). Escalation to RCE was attempted and not observed.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.34"
},
"package": {
"ecosystem": "npm",
"name": "@nyariv/sandboxjs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.35"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-32723"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-16T16:43:05Z",
"nvd_published_at": "2026-03-18T22:16:24Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nAssumed repo path is `/Users/zwique/Downloads/SandboxJS-0.8.34` (no `/Users/zwique/Downloads/SandboxJS` found). A global tick state (`currentTicks.current`) is shared between sandboxes. Timer string handlers are compiled at execution time using that global tick state rather than the scheduling sandbox\u0027s tick object. In multi-tenant / concurrent sandbox scenarios, another sandbox can overwrite `currentTicks.current` between scheduling and execution, causing the timer callback to run under a different sandbox\u0027s tick budget and bypass the original sandbox\u0027s execution quota/watchdog.\n\n**Impact:** execution quota bypass \u2192 CPU/resource abuse \n\n---\n\n## Details\n\n- **Affected project:** SandboxJS (owner: nyariv)\n- **Assumed checked-out version:** `SandboxJS-0.8.34` at `/Users/zwique/Downloads/SandboxJS-0.8.34`\n\n### Vulnerable code paths\n\n- **`/src/eval.ts`** \u2014 `sandboxFunction` binds `ticks` using `ticks || currentTicks.current`:\n ```\n createFunction(..., ticks || currentTicks.current, { ...context, ... })\n ```\n Relevant lines: 44, 53, 164, 167.\n\n- **`/src/evaluator.ts` / `/src/executor.ts`** \u2014 global ticks:\n ```\n export const currentTicks = { current: { ticks: BigInt(0) } as Ticks };\n ```\n and\n ```\n _execNoneRecurse(...) { currentTicks.current = ticks; ... }\n ```\n Relevant lines: ~1700, 1712.\n\n- **`sandboxedSetTimeout`** compiles string handlers at execution time, not at scheduling time, which lets `currentTicks.current` be the wrong sandbox\u0027s ticks when compilation occurs.\n\n---\n\n## Why This Is Vulnerable\n\n- `currentTicks.current` is global mutable state shared across all sandbox instances.\n- Timer string handlers are compiled at the moment the timer fires and read `currentTicks.current` at that time. If another sandbox runs between scheduling and execution, it can replace `currentTicks.current`. The scheduled timer\u0027s code will be compiled/executed with the other sandbox\u0027s tick budget. This allows the original sandbox\u0027s execution quota to be bypassed.\n\n---\n\n## Proof of Concept\n\n\u003e Run with Node.js; adjust path if needed.\n\n```js\n// PoC (run with node); adjust path if needed\nimport Sandbox from \u0027/Users/zwique/Downloads/SandboxJS-0.8.34/node_modules/@nyariv/sandboxjs/build/Sandbox.js\u0027;\n\nconst globals = { ...Sandbox.SAFE_GLOBALS, setTimeout, clearTimeout };\nconst prototypeWhitelist = Sandbox.SAFE_PROTOTYPES;\n\nconst sandboxA = new Sandbox({\n globals,\n prototypeWhitelist,\n executionQuota: 50n,\n haltOnSandboxError: true,\n});\nlet haltedA = false;\nsandboxA.subscribeHalt(() =\u003e { haltedA = true; });\n\nconst sandboxB = new Sandbox({ globals, prototypeWhitelist });\n\n// Sandbox A schedules a heavy string handler\nsandboxA.compile(\n \u0027setTimeout(\"let x=0; for (let i=0;i\u003c200;i++){ x += i } globalThis.doneA = true;\", 0);\u0027\n)().run();\n\n// Run sandbox B before A\u0027s timer fires\nsandboxB.compile(\u00271+1\u0027)().run();\n\nsetTimeout(() =\u003e {\n console.log({ haltedA, doneA: sandboxA.context.sandboxGlobal.doneA });\n}, 50);\n```\n\n### Reproduction Steps\n\n1. Place the PoC in `hi.js` and run:\n ```\n node /Users/zwique/Downloads/SandboxJS-0.8.34/hi.js\n ```\n\n2. Observe output similar to:\n ```\n { haltedA: false, doneA: true }\n ```\n This indicates the heavy loop completed and the quota was bypassed.\n\n3. Remove the `sandboxB.compile(\u00271+1\u0027)().run();` line and rerun. Output should now be:\n ```\n { haltedA: true }\n ```\n This indicates quota enforcement is working correctly.\n\n---\n\n## Impact\n\n- **Type:** Runtime guard bypass (execution-quota / watchdog bypass)\n- **Who is impacted:** Applications that run multiple SandboxJS instances concurrently in the same process \u2014 multi-tenant interpreters, plugin engines, server-side scripting hosts, online code runners.\n- **Practical impact:** Attackers controlling sandboxed code can bypass configured execution quotas/watchdog and perform CPU-intensive loops or long-running computation, enabling resource exhaustion/DoS or denial of service against the host process or other tenants.\n- **Does not (as tested) lead to:** Host object exposure or direct sandbox escape (no `process` / `require` leakage observed from this primitive alone). Escalation to RCE was attempted and not observed.",
"id": "GHSA-7p5m-xrh7-769r",
"modified": "2026-03-19T21:11:10Z",
"published": "2026-03-16T16:43:05Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nyariv/SandboxJS/security/advisories/GHSA-7p5m-xrh7-769r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32723"
},
{
"type": "WEB",
"url": "https://github.com/nyariv/SandboxJS/commit/cc8f20b4928afed5478d5ad3d1737ef2dcfaac29"
},
{
"type": "PACKAGE",
"url": "https://github.com/nyariv/SandboxJS"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "SandboxJS has an execution-quota bypass (cross-sandbox currentTicks race) in SandboxJS timers"
}
GHSA-7P63-W6X9-6GR7
Vulnerability from github – Published: 2025-11-18 18:32 – Updated: 2026-02-05 15:43In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.glassfish.jersey.core:jersey-client"
},
"ranges": [
{
"events": [
{
"introduced": "2.45"
},
{
"fixed": "2.46"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.45"
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.glassfish.jersey.core:jersey-client"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.16"
},
{
"fixed": "3.0.17"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.0.16"
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.glassfish.jersey.core:jersey-client"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.9"
},
{
"fixed": "3.1.10"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"3.1.9"
]
}
],
"aliases": [
"CVE-2025-12383"
],
"database_specific": {
"cwe_ids": [
"CWE-296",
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-18T20:38:31Z",
"nvd_published_at": "2025-11-18T16:15:42Z",
"severity": "CRITICAL"
},
"details": "In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)",
"id": "GHSA-7p63-w6x9-6gr7",
"modified": "2026-02-05T15:43:36Z",
"published": "2025-11-18T18:32:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12383"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/pull/5749"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/pull/5794"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/commit/425bc883d8d623ef8d3c448fafd36729f7741bcb"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/commit/b2c7ba6d388cb9722f39073d7e82aa818fec49d5"
},
{
"type": "WEB",
"url": "https://github.com/dtbaum/jerseyCveCandidate"
},
{
"type": "PACKAGE",
"url": "https://github.com/eclipse-ee4j/jersey"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/2.46"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/3.0.17"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/3.1.10"
},
{
"type": "WEB",
"url": "https://github.com/eclipse-ee4j/jersey/releases/tag/4.0.0-M2"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/cve-assignment/-/issues/74"
},
{
"type": "WEB",
"url": "https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/253"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Eclipse Jersey has a Race Condition"
}
GHSA-7P72-HG7M-3627
Vulnerability from github – Published: 2026-03-25 15:31 – Updated: 2026-03-25 18:31In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.
{
"affected": [],
"aliases": [
"CVE-2025-32991"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-25T15:16:28Z",
"severity": "CRITICAL"
},
"details": "In N2WS Backup \u0026 Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.",
"id": "GHSA-7p72-hg7m-3627",
"modified": "2026-03-25T18:31:46Z",
"published": "2026-03-25T15:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32991"
},
{
"type": "WEB",
"url": "https://n2ws.com/blog/security-advisory-update"
},
{
"type": "WEB",
"url": "https://www.n2ws.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7P73-RPM9-RWR6
Vulnerability from github – Published: 2024-08-14 18:32 – Updated: 2024-08-14 18:32The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a race condition in the management of ORB listener threads. IBM X-Force ID: 284573.
{
"affected": [],
"aliases": [
"CVE-2024-27267"
],
"database_specific": {
"cwe_ids": [
"CWE-300",
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-14T16:15:10Z",
"severity": "MODERATE"
},
"details": "The Object Request Broker (ORB) in IBM SDK, Java Technology Edition 7.1.0.0 through 7.1.5.18 and 8.0.0.0 through 8.0.8.26 is vulnerable to remote denial of service, caused by a race condition in the management of ORB listener threads. IBM X-Force ID: 284573.",
"id": "GHSA-7p73-rpm9-rwr6",
"modified": "2024-08-14T18:32:41Z",
"published": "2024-08-14T18:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27267"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/284573"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7165421"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7PCQ-MHVW-4MGV
Vulnerability from github – Published: 2023-10-10 18:31 – Updated: 2024-04-04 08:32Win32k Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-36776"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-10T18:15:17Z",
"severity": "HIGH"
},
"details": "Win32k Elevation of Privilege Vulnerability",
"id": "GHSA-7pcq-mhvw-4mgv",
"modified": "2024-04-04T08:32:21Z",
"published": "2023-10-10T18:31:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36776"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36776"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7PHV-9JP9-84FQ
Vulnerability from github – Published: 2026-04-14 18:30 – Updated: 2026-04-14 18:30Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-32083"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-14T18:17:11Z",
"severity": "HIGH"
},
"details": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) in Windows SSDP Service allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-7phv-9jp9-84fq",
"modified": "2026-04-14T18:30:40Z",
"published": "2026-04-14T18:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32083"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32083"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7PM6-874P-WG6J
Vulnerability from github – Published: 2023-06-06 15:30 – Updated: 2024-04-04 04:35In swpm, there is a possible out of bounds write due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780926; Issue ID: ALPS07780928.
{
"affected": [],
"aliases": [
"CVE-2023-20750"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-06T13:15:15Z",
"severity": "MODERATE"
},
"details": "In swpm, there is a possible out of bounds write due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780926; Issue ID: ALPS07780928.",
"id": "GHSA-7pm6-874p-wg6j",
"modified": "2024-04-04T04:35:47Z",
"published": "2023-06-06T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20750"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/June-2023"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7PRJ-H6R4-GH9J
Vulnerability from github – Published: 2024-05-21 18:31 – Updated: 2025-01-14 18:31In the Linux kernel, the following vulnerability has been resolved:
scsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR
If command timeout happens and cq complete IRQ is raised at the same time, ufshcd_mcq_abort clears lprb->cmd and a NULL pointer deref happens in the ISR. Error log:
ufshcd_abort: Device abort task at tag 18 Unable to handle kernel NULL pointer dereference at virtual address 0000000000000108 pc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44 lr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114
{
"affected": [],
"aliases": [
"CVE-2023-52785"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-21T16:15:17Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix racing issue between ufshcd_mcq_abort() and ISR\n\nIf command timeout happens and cq complete IRQ is raised at the same time,\nufshcd_mcq_abort clears lprb-\u003ecmd and a NULL pointer deref happens in the\nISR. Error log:\n\nufshcd_abort: Device abort task at tag 18\nUnable to handle kernel NULL pointer dereference at virtual address\n0000000000000108\npc : [0xffffffe27ef867ac] scsi_dma_unmap+0xc/0x44\nlr : [0xffffffe27f1b898c] ufshcd_release_scsi_cmd+0x24/0x114",
"id": "GHSA-7prj-h6r4-gh9j",
"modified": "2025-01-14T18:31:50Z",
"published": "2024-05-21T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52785"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/27900d7119c464b43cd9eac69c85884d17bae240"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8f15a7e3c054d960bbd1521110700450bbf798a1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f84d461f33a6b27304d468d9cfb56c0cefdb4ee7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7PWR-CFRC-PX4F
Vulnerability from github – Published: 2024-04-18 21:30 – Updated: 2025-11-03 21:31A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
{
"affected": [],
"aliases": [
"CVE-2023-3758"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-18T19:15:08Z",
"severity": "HIGH"
},
"details": "A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.",
"id": "GHSA-7pwr-cfrc-px4f",
"modified": "2025-11-03T21:31:03Z",
"published": "2024-04-18T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3758"
},
{
"type": "WEB",
"url": "https://github.com/SSSD/sssd/pull/7302"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1919"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1920"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1921"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:1922"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:2571"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2024:3270"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-3758"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2223762"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00008.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RV3HIZI3SURBUQKSOOL3XE64OOBQ2HTK"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XEP62IDS7A55D5UHM6GH7QZ7SQFOAPVF"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XMORAO2BDDA5YX4ZLMXDZ7SM6KU47SY5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.