CWE-362— Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.— MITRE CWE catalog

3,069 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-362page 56 of 62

CVE-2020-35913MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of RwLockReadGuard unsoundness.
CVE-2020-35912MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockWriteGuard unsoundness.
CVE-2020-35911MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the lock_api crate before 0.4.2 for Rust. A data race can occur because of MappedRwLockReadGuard unsoundness.
CVE-2020-35905MEDIUMCVSS 4.7EG 4.7
2020-12-31
An issue was discovered in the futures-util crate before 0.3.7 for Rust. MutexGuard::map can cause a data race for certain closure situations (in safe code).
CVE-2020-29372MEDIUMCVSS 4.7EG 4.7
2020-11-28
An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation, aka CID-bc0c4d1e176e.
CVE-2020-27675MEDIUMCVSS 4.7EG 4.7
2020-10-22
An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause a use-after-free or…
CVE-2020-25604MEDIUMCVSS 4.7EG 4.7
2020-09-23
An issue was discovered in Xen through 4.14.x. There is a race condition when migrating timers between x86 HVM vCPUs. When migrating timers of x86 HVM guests between its vCPUs, the locking model used allows for a second vCPU of the same gu…
CVE-2020-0373MEDIUMCVSS 4.7EG 4.7
2020-09-17
In SoundTriggerHwService, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Produ…
CVE-2020-4387MEDIUMCVSS 4.7EG 4.7
2020-07-01
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179269.
CVE-2020-4386MEDIUMCVSS 4.7EG 4.7
2020-07-01
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to obtain sensitive information using a race condition of a symbolic link. IBM X-Force ID: 179268.
CVE-2020-5967MEDIUMCVSS 4.7EG 4.7
2020-06-25
NVIDIA Linux GPU Display Driver, all versions, contains a vulnerability in the UVM driver, in which a race condition may lead to a denial of service.
CVE-2020-12114MEDIUMCVSS 4.7EG 4.7
2020-05-04
A pivot_root race condition in fs/namespace.c in the Linux kernel 4.4.x before 4.4.221, 4.9.x before 4.9.221, 4.14.x before 4.14.178, 4.19.x before 4.19.119, and 5.x before 5.3 allows local users to cause a denial of service (panic) by cor…
CVE-2020-0568MEDIUMCVSS 4.7EG 4.7
2020-04-15
Race condition in the Intel(R) Driver and Support Assistant before version 20.1.5 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2020-0008MEDIUMCVSS 4.7EG 4.7
2020-01-08
In LowEnergyClient::MtuChangedCallback of low_energy_client.cc, there is a possible out of bounds read due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interactio…
CVE-2011-3585MEDIUMCVSS 4.7EG 4.7
2019-12-31
Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.
CVE-2019-19965MEDIUMCVSS 4.7EG 4.7
2019-12-25
In the Linux kernel through 5.4.6, there is a NULL pointer dereference in drivers/scsi/libsas/sas_discover.c because of mishandling of port disconnection during discovery, related to a PHY down race condition, aka CID-f70267f379b5.
CVE-2019-2219MEDIUMCVSS 4.7EG 4.7
2019-12-06
In several functions of NotificationManagerService.java and related files, there is a possible way to record audio from the background without notification to the user due to a permission bypass. This could lead to local escalation of priv…
CVE-2014-5254MEDIUMCVSS 4.7EG 4.7
2019-11-21
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.
CVE-2019-16354MEDIUMCVSS 4.7EG 4.7
2019-09-16
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
CVE-2019-14694MEDIUMCVSS 4.7EG 4.7
2019-08-28
A use-after-free flaw in the sandbox container implemented in cmdguard.sys in Comodo Antivirus 12.0.0.6870 can be triggered due to a race condition when handling IRP_MJ_CLEANUP requests in the minifilter for directory change notifications.…
CVE-2019-0114MEDIUMCVSS 4.7EG 4.7
2019-05-17
A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.
CVE-2019-11190MEDIUMCVSS 4.7EG 4.7
2019-04-12
The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race c…
CVE-2016-10741MEDIUMCVSS 4.7EG 4.7
2019-02-01
In the Linux kernel before 4.9.3, fs/xfs/xfs_aops.c allows local users to cause a denial of service (system crash) because there is a race condition between direct and memory-mapped I/O (associated with a hole) that is handled with BUG_ON …
CVE-2018-19489MEDIUMCVSS 4.7EG 4.7
2018-12-13
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.
CVE-2017-18302MEDIUMCVSS 4.7EG 4.7
2018-09-20
In Snapdragon (Automobile ,Mobile) in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, a crafted HLOS c…
CVE-2018-15499MEDIUMCVSS 4.7EG 4.7
2018-08-24
GEAR Software products that include GEARAspiWDM.sys, 2.2.5.0, allow local users to cause a denial of service (Race Condition and BSoD on Windows) by not checking that user-mode memory is available right before writing to it. A check is onl…
CVE-2018-14329MEDIUMCVSS 4.7EG 4.7
2018-07-17
In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.
CVE-2018-4092MEDIUMCVSS 4.7EG 4.7
2018-04-03
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. A race conditi…
CVE-2017-9691MEDIUMCVSS 4.7EG 4.7
2018-03-30
There is a race condition in Android for MSM, Firefox OS for MSM, and QRD Android that allows to access to already free'd memory in the debug message output functionality contained within the mobicore driver.
CVE-2017-18224MEDIUMCVSS 4.7EG 4.7
2018-03-12
In the Linux kernel before 4.15, fs/ocfs2/aops.c omits use of a semaphore and consequently has a race condition for access to the extent tree during read operations in DIRECT mode, which allows local users to cause a denial of service (BUG…
CVE-2018-7995MEDIUMCVSS 4.7EG 4.7
2018-03-09
Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (panic) by leveraging root access to write to the check_interval…
CVE-2017-18203MEDIUMCVSS 4.7EG 4.7
2018-02-27
The dm_get_from_kobject function in drivers/md/dm.c in the Linux kernel before 4.14.3 allow local users to cause a denial of service (BUG) by leveraging a race condition with __dm_destroy during creation and removal of DM devices.
CVE-2017-8148MEDIUMCVSS 4.7EG 4.7
2017-11-22
Audio driver in P9 smartphones with software The versions before EVA-AL10C00B389 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and the race condition caus…
CVE-2017-9676MEDIUMCVSS 4.7EG 4.7
2017-09-21
In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing global static variables without using a lock.
CVE-2017-8281MEDIUMCVSS 4.7EG 4.7
2017-09-21
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition can allow access to already freed memory while querying event status via DCI.
CVE-2015-7553MEDIUMCVSS 4.7EG 4.7
2017-09-14
Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
CVE-2017-9682MEDIUMCVSS 4.7EG 4.7
2017-08-18
In all Qualcomm products with Android releases from CAF using the Linux kernel, a race condition in two KGSL driver functions can lead to a Use After Free condition.
CVE-2016-4984MEDIUMCVSS 4.7EG 4.7
2017-07-17
/usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate,…
CVE-2016-4982MEDIUMCVSS 4.7EG 4.7
2017-07-17
authd sets weak permissions for /etc/ident.key, which allows local users to obtain the key by leveraging a race condition between the creation of the key, and the chmod to protect it.
CVE-2016-6136MEDIUMCVSS 4.7EG 4.7
2016-08-06
Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, a…
CVE-2016-3258MEDIUMCVSS 4.7EG 4.7
2016-07-13
Race condition in the kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to bypass the Low Integrity protection mechanism and write to files by leveraging unspe…
CVE-2016-6130MEDIUMCVSS 4.7EG 4.7
2016-07-03
Race condition in the sclp_ctl_ioctl_sccb function in drivers/s390/char/sclp_ctl.c in the Linux kernel before 4.6 allows local users to obtain sensitive information from kernel memory by changing a certain length value, aka a "double fetch…
CVE-2015-4170MEDIUMCVSS 4.7EG 4.7
2016-05-02
Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new…
CVE-2014-3611MEDIUMCVSS 4.7EG 4.7
2014-11-10
Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.
CVE-2014-8086MEDIUMCVSS 4.7EG 4.7
2014-10-13
Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation…
CVE-2009-4895MEDIUMCVSS 4.7EG 4.7
2010-09-08
Race condition in the tty_fasync function in drivers/char/tty_io.c in the Linux kernel before 2.6.32.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact vi…
CVE-2009-1961MEDIUMCVSS 4.7EG 4.7
2009-06-08
The inode double locking code in fs/ocfs2/file.c in the Linux kernel 2.6.30 before 2.6.30-rc3, 2.6.27 before 2.6.27.24, 2.6.29 before 2.6.29.4, and possibly other versions down to 2.6.19 allows local users to cause a denial of service (pre…
CVE-2013-7026MEDIUMCVSS v2 4.7EG 4.7
2013-12-09
Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted application that uses shmctl I…
CVE-2013-1792MEDIUMCVSS v2 4.7EG 4.7
2013-03-22
Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system cal…
CVE-2008-6819MEDIUMCVSS v2 4.7EG 4.7
2009-06-01
win32k.sys in Microsoft Windows Server 2003 and Vista allows local users to cause a denial of service (system crash) via vectors related to CreateWindow, TranslateMessage, and DispatchMessage, possibly a race condition between threads, a d…

Map vulnerabilities like CWE-362 to your infrastructure

EchelonGraph correlates every CVE — across CWE-362 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →