CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Description
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-26 · CAPEC-29
CVEs mapped to this weakness (2,607)
page 44 of 131| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2021-39660 | Hig | 0.46 | 7.0 | 0.00 | Dec 13, 2022 | In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:… | ||
| CVE-2022-45884 | Hig | 0.46 | 7.0 | 0.00 | Nov 25, 2022 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops. | ||
| CVE-2022-41114 | Hig | 0.46 | 7.0 | 0.01 | Nov 9, 2022 | Windows Bind Filter Driver Elevation of Privilege Vulnerability | ||
| CVE-2022-38014 | Hig | 0.46 | 7.0 | 0.00 | Nov 9, 2022 | Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability | ||
| CVE-2022-42806 | Hig | 0.46 | 7.0 | 0.00 | Nov 1, 2022 | A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges. | ||
| CVE-2022-42803 | Hig | 0.46 | 7.0 | 0.00 | Nov 1, 2022 | A race condition was addressed with improved locking. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1. An app may be able to execute arbitrary code with kernel privileges. | ||
| CVE-2022-42791 | Hig | 0.46 | 7.0 | 0.00 | Nov 1, 2022 | A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges. | ||
| CVE-2021-0696 | Hig | 0.46 | 7.0 | 0.00 | Oct 11, 2022 | In dllist_remove_node of TBD, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android… | ||
| CVE-2022-38029 | Hig | 0.46 | 7.0 | 0.01 | Oct 11, 2022 | Windows ALPC Elevation of Privilege Vulnerability | ||
| CVE-2022-38027 | Hig | 0.46 | 7.0 | 0.00 | Oct 11, 2022 | Windows Storage Elevation of Privilege Vulnerability | ||
| CVE-2022-38021 | Hig | 0.46 | 7.0 | 0.00 | Oct 11, 2022 | Connected User Experiences and Telemetry Elevation of Privilege Vulnerability | ||
| CVE-2021-0697 | Hig | 0.46 | 7.0 | 0.00 | Sep 13, 2022 | In PVRSRVRGXSubmitTransferKM of rgxtransfer.c, there is a possible user after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:… | ||
| CVE-2022-34725 | Hig | 0.46 | 7.0 | 0.05 | Sep 13, 2022 | Windows ALPC Elevation of Privilege Vulnerability | ||
| CVE-2022-26928 | Hig | 0.46 | 7.0 | 0.01 | Sep 13, 2022 | Windows Photo Import API Elevation of Privilege Vulnerability | ||
| CVE-2022-2590 | Hig | 0.46 | 7.0 | 0.01 | Aug 31, 2022 | A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their… | ||
| CVE-2022-1247 | Hig | 0.46 | 7.0 | 0.00 | Aug 31, 2022 | An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and… | ||
| CVE-2022-2961 | Hig | 0.46 | 7.0 | 0.00 | Aug 29, 2022 | A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on… | ||
| CVE-2022-24951 | Hig | 0.46 | 7.0 | 0.00 | Aug 16, 2022 | A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future. | ||
| CVE-2022-20344 | Hig | 0.46 | 7.0 | 0.00 | Aug 10, 2022 | In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for… | ||
| CVE-2022-24800 | Hig | 0.46 | 8.1 | 0.01 | Jul 12, 2022 | October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user… |
- risk 0.46cvss 7.0epss 0.00
In TBD of TBD, there is a possible way to archive arbitrary code execution in kernel due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:…
- risk 0.46cvss 7.0epss 0.00
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.
- risk 0.46cvss 7.0epss 0.01
Windows Bind Filter Driver Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
A race condition was addressed with improved locking. This issue is fixed in iOS 16.1 and iPadOS 16, macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
- risk 0.46cvss 7.0epss 0.00
A race condition was addressed with improved locking. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16, macOS Monterey 12.6.1. An app may be able to execute arbitrary code with kernel privileges.
- risk 0.46cvss 7.0epss 0.00
A race condition was addressed with improved state handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
- risk 0.46cvss 7.0epss 0.00
In dllist_remove_node of TBD, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android…
- risk 0.46cvss 7.0epss 0.01
Windows ALPC Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
Windows Storage Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
In PVRSRVRGXSubmitTransferKM of rgxtransfer.c, there is a possible user after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:…
- risk 0.46cvss 7.0epss 0.05
Windows ALPC Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.01
Windows Photo Import API Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.01
A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only shared memory mappings. This flaw allows an unprivileged, local user to gain write access to read-only memory mappings, increasing their…
- risk 0.46cvss 7.0epss 0.00
An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and…
- risk 0.46cvss 7.0epss 0.00
A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on…
- risk 0.46cvss 7.0epss 0.00
A race condition exists in Eternal Terminal prior to version 6.2.0 which allows a local attacker to hijack Eternal Terminal's IPC socket, enabling access to Eternal Terminal clients which attempt to connect in the future.
- risk 0.46cvss 7.0epss 0.00
In stealReceiveChannel of EventThread.cpp, there is a possible way to interfere with process communication due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
- risk 0.46cvss 8.1epss 0.01
October/System is the system module for October CMS, a self-hosted CMS platform based on the Laravel PHP Framework. Prior to versions 1.0.476, 1.1.12, and 2.2.15, when the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user…