CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2900 vulnerabilities reference this CWE, most recent first.
GHSA-WC9W-8X8G-533G
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2024-03-14 21:30Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.
{
"affected": [],
"aliases": [
"CVE-2014-9529"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-01-09T21:59:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.",
"id": "GHSA-wc9w-8x8g-533g",
"modified": "2024-03-14T21:30:49Z",
"published": "2022-05-13T01:26:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9529"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/a3a8784454692dd72e5d5d34dcdab17b4420e74c"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1179813"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/99641"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a3a8784454692dd72e5d5d34dcdab17b4420e74c"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a3a8784454692dd72e5d5d34dcdab17b4420e74c"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-0864.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1137.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2015-1138.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3128"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:058"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/01/06/10"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/71880"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1036763"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2511-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2512-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2513-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2514-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2515-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2516-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2517-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2518-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WCCJ-RQRC-G885
Vulnerability from github – Published: 2024-12-27 15:31 – Updated: 2025-01-14 18:31In the Linux kernel, the following vulnerability has been resolved:
binder: fix node UAF in binder_add_freeze_work()
In binder_add_freeze_work() we iterate over the proc->nodes with the proc->inner_lock held. However, this lock is temporarily dropped in order to acquire the node->lock first (lock nesting order). This can race with binder_node_release() and trigger a use-after-free:
================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff53c04c29dd04 by task freeze/640
CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_add_freeze_work+0x148/0x478 binder_ioctl+0x1e70/0x25ac __arm64_sys_ioctl+0x124/0x190
Allocated by task 637: __kmalloc_cache_noprof+0x12c/0x27c binder_new_node+0x50/0x700 binder_transaction+0x35ac/0x6f74 binder_thread_write+0xfb8/0x42a0 binder_ioctl+0x18f0/0x25ac __arm64_sys_ioctl+0x124/0x190
Freed by task 637: kfree+0xf0/0x330 binder_thread_read+0x1e88/0x3a68 binder_ioctl+0x16d8/0x25ac __arm64_sys_ioctl+0x124/0x190 ==================================================================
Fix the race by taking a temporary reference on the node before releasing the proc->inner lock. This ensures the node remains alive while in use.
{
"affected": [],
"aliases": [
"CVE-2024-56556"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-27T15:15:14Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinder: fix node UAF in binder_add_freeze_work()\n\nIn binder_add_freeze_work() we iterate over the proc-\u003enodes with the\nproc-\u003einner_lock held. However, this lock is temporarily dropped in\norder to acquire the node-\u003elock first (lock nesting order). This can\nrace with binder_node_release() and trigger a use-after-free:\n\n ==================================================================\n BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c\n Write of size 4 at addr ffff53c04c29dd04 by task freeze/640\n\n CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17\n Hardware name: linux,dummy-virt (DT)\n Call trace:\n _raw_spin_lock+0xe4/0x19c\n binder_add_freeze_work+0x148/0x478\n binder_ioctl+0x1e70/0x25ac\n __arm64_sys_ioctl+0x124/0x190\n\n Allocated by task 637:\n __kmalloc_cache_noprof+0x12c/0x27c\n binder_new_node+0x50/0x700\n binder_transaction+0x35ac/0x6f74\n binder_thread_write+0xfb8/0x42a0\n binder_ioctl+0x18f0/0x25ac\n __arm64_sys_ioctl+0x124/0x190\n\n Freed by task 637:\n kfree+0xf0/0x330\n binder_thread_read+0x1e88/0x3a68\n binder_ioctl+0x16d8/0x25ac\n __arm64_sys_ioctl+0x124/0x190\n ==================================================================\n\nFix the race by taking a temporary reference on the node before\nreleasing the proc-\u003einner lock. This ensures the node remains alive\nwhile in use.",
"id": "GHSA-wccj-rqrc-g885",
"modified": "2025-01-14T18:31:54Z",
"published": "2024-12-27T15:31:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56556"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/38fbefeb2c140b581ed7de8117a5c90d6dd89c22"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/dc8aea47b928cc153b591b3558829ce42f685074"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WCH3-7X83-FQ5H
Vulnerability from github – Published: 2022-05-14 02:09 – Updated: 2022-05-14 02:09Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2014-7154"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-10-02T14:55:00Z",
"severity": "MODERATE"
},
"details": "Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.",
"id": "GHSA-wch3-7x83-fq5h",
"modified": "2022-05-14T02:09:43Z",
"published": "2022-05-14T02:09:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7154"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140418.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140483.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/61501"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/61890"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201412-42.xml"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-3041"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1030887"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-104.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WCQX-V7MJ-X2H4
Vulnerability from github – Published: 2022-05-14 01:20 – Updated: 2022-05-14 01:20Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2018-0492"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-04-03T07:29:00Z",
"severity": "HIGH"
},
"details": "Johnathan Nightingale beep through 1.3.4, if setuid, has a race condition that allows local privilege escalation.",
"id": "GHSA-wcqx-v7mj-x2h4",
"modified": "2022-05-14T01:20:24Z",
"published": "2022-05-14T01:20:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0492"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/04/msg00002.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-security-announce/2018/msg00089.html"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2018-0492"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201805-15"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4163"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44452"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WF2Q-WPCG-Q95R
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20Race condition in PSP FW could allow less privileged x86 code to perform PSP SMM operations.
{
"affected": [],
"aliases": [
"CVE-2020-12951"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-16T19:15:00Z",
"severity": "HIGH"
},
"details": "Race condition in PSP FW could allow less privileged x86 code to perform PSP SMM operations.",
"id": "GHSA-wf2q-wpcg-q95r",
"modified": "2022-05-24T19:20:48Z",
"published": "2022-05-24T19:20:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12951"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1021"
},
{
"type": "WEB",
"url": "https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1027"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WF3J-PH5H-5R7Q
Vulnerability from github – Published: 2022-05-17 03:50 – Updated: 2022-05-17 03:50Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.
{
"affected": [],
"aliases": [
"CVE-2015-1882"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-04-27T12:59:00Z",
"severity": "HIGH"
},
"details": "Multiple race conditions in IBM WebSphere Application Server (WAS) 8.5 Liberty Profile before 8.5.5.5 allow remote authenticated users to gain privileges by leveraging thread conflicts that result in Java code execution outside the context of the configured EJB Run-as user.",
"id": "GHSA-wf3j-ph5h-5r7q",
"modified": "2022-05-17T03:50:34Z",
"published": "2022-05-17T03:50:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1882"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI33357"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21697368"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74222"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032190"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WF3V-XJG6-86HX
Vulnerability from github – Published: 2022-05-13 01:27 – Updated: 2025-04-20 03:38Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.
{
"affected": [],
"aliases": [
"CVE-2017-6512"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-01T16:29:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the rmtree and remove_tree functions in the File-Path module before 2.13 for Perl allows attackers to set the mode on arbitrary files via vectors involving directory-permission loosening logic.",
"id": "GHSA-wf3v-xjg6-86hx",
"modified": "2025-04-20T03:38:24Z",
"published": "2022-05-13T01:27:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6512"
},
{
"type": "WEB",
"url": "https://rt.cpan.org/Ticket/Display.html?id=121951"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201709-12"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3625-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3625-2"
},
{
"type": "WEB",
"url": "http://cpansearch.perl.org/src/JKEENAN/File-Path-2.13/Changes"
},
{
"type": "WEB",
"url": "http://security.cucumberlinux.com/security/details.php?id=153"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3873"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99180"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038610"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WF83-P2HM-5F3V
Vulnerability from github – Published: 2025-01-22 00:33 – Updated: 2025-01-22 18:31In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
{
"affected": [],
"aliases": [
"CVE-2024-49724"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T23:15:14Z",
"severity": "HIGH"
},
"details": "In multiple functions of AccountManagerService.java, there is a possible way to bypass permissions and launch protected activities due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.",
"id": "GHSA-wf83-p2hm-5f3v",
"modified": "2025-01-22T18:31:55Z",
"published": "2025-01-22T00:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49724"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2025-01-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WFCP-R54J-FRMQ
Vulnerability from github – Published: 2022-05-02 06:13 – Updated: 2022-05-02 06:13Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka "Race Condition Memory Corruption Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2010-0489"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-03-31T19:30:00Z",
"severity": "HIGH"
},
"details": "Race condition in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a crafted HTML document that triggers memory corruption, aka \"Race Condition Memory Corruption Vulnerability.\"",
"id": "GHSA-wfcp-r54j-frmq",
"modified": "2022-05-02T06:13:06Z",
"published": "2022-05-02T06:13:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0489"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7774"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1023773"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/39026"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-068A.html"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA10-089A.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/0744"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WG48-GXWC-C947
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-05-24 17:22In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root.
{
"affected": [],
"aliases": [
"CVE-2020-15396"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-30T12:15:00Z",
"severity": "HIGH"
},
"details": "In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root.",
"id": "GHSA-wg48-gxwc-c947",
"modified": "2022-05-24T17:22:06Z",
"published": "2022-05-24T17:22:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15396"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1173521"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/J52QFVREJWJ35YSEEDDRMZQ2LM2H2WE6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y46FOVJUS5SO44A2VEKR7DXEHTI4WK5L"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202007-06"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/hylafax/HylaFAX+/2534"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00040.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00046.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00054.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.