CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
3577 vulnerabilities reference this CWE, most recent first.
GHSA-496X-5V3M-GFF3
Vulnerability from github – Published: 2023-07-24 18:30 – Updated: 2024-08-22 21:31A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.
{
"affected": [],
"aliases": [
"CVE-2023-32258"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-667"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-24T16:15:11Z",
"severity": "HIGH"
},
"details": "A flaw was found in the Linux kernel\u0027s ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_LOGOFF and SMB2_CLOSE commands. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to execute code in the context of the kernel.",
"id": "GHSA-496x-5v3m-gff3",
"modified": "2024-08-22T21:31:27Z",
"published": "2023-07-24T18:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32258"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2023-32258"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219809"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20230915-0011"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-CAN-20796"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-497G-7JRR-6MCV
Vulnerability from github – Published: 2025-10-14 18:30 – Updated: 2025-10-14 18:30Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2025-53150"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-14T17:15:43Z",
"severity": "HIGH"
},
"details": "Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-497g-7jrr-6mcv",
"modified": "2025-10-14T18:30:29Z",
"published": "2025-10-14T18:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53150"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-53150"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-497J-X834-CGHH
Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-10-21 15:40In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: fix amdgpu_hmm_range_get_pages
The notifier sequence must only be read once or otherwise we could work with invalid pages.
While at it also fix the coding style, e.g. drop the pre-initialized return value and use the common define for 2G range.
(cherry picked from commit c08972f555945cda57b0adb72272a37910153390)
{
"affected": [],
"aliases": [
"CVE-2026-63879"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-19T16:17:04Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: fix amdgpu_hmm_range_get_pages\n\nThe notifier sequence must only be read once or otherwise we could work\nwith invalid pages.\n\nWhile at it also fix the coding style, e.g. drop the pre-initialized\nreturn value and use the common define for 2G range.\n\n(cherry picked from commit c08972f555945cda57b0adb72272a37910153390)",
"id": "GHSA-497j-x834-cghh",
"modified": "2026-10-21T15:40:41Z",
"published": "2026-07-19T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63879"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2fd24407457a6b181ba827705678da70e528dcd0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/93a9f121de6383f20290840d025ee28fda5f53b5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/962d684b5dc0741dcd93485d41b450de402d5592"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e35cf322897dd4921248d11311a89c865b534c14"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fa34d3e14cb763b50702e8a0f7d4cfd877a73ab9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4985-WCH3-93JR
Vulnerability from github – Published: 2022-03-10 00:00 – Updated: 2022-03-17 00:02Windows NT OS Kernel Elevation of Privilege Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2022-23298"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-09T17:15:00Z",
"severity": "HIGH"
},
"details": "Windows NT OS Kernel Elevation of Privilege Vulnerability.",
"id": "GHSA-4985-wch3-93jr",
"modified": "2022-03-17T00:02:26Z",
"published": "2022-03-10T00:00:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23298"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23298"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-23298"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-49C8-7MPF-M266
Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-10-15 03:36In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove
In qrtr_port_remove(), the socket reference count is decremented via __sock_put() before the port is removed from the qrtr_ports XArray and before the RCU grace period elapses.
This breaks the fundamental RCU update paradigm. It exposes a race window where a concurrent RCU reader (such as qrtr_reset_ports() or qrtr_port_lookup()) can obtain a pointer to the socket from the XArray, and attempt to call sock_hold() on a socket whose reference count has already dropped to zero.
This exact race condition was hit during syzkaller fuzzing, leading to the following refcount saturation warning and a potential Use-After-Free:
refcount_t: saturated; leaking memory. WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0 Modules linked in: qrtr(+) bochs drm_shmem_helper ... Call Trace: qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr] __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr] qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr] kernel_bind+0xe4/0x120 net/socket.c:3592 qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr] qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr] do_one_initcall+0xf5/0x5e0 init/main.c:1283 ...
Fix this by deferring the reference count decrement until after the xa_erase() and the synchronize_rcu() complete.
(Note: The v1 of this patch incorrectly replaced __sock_put() with sock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove() still hold a reference to the socket, so freeing the socket memory here would lead to a subsequent UAF in the caller. Thus, the __sock_put() is kept, but only repositioned to close the RCU race.)
{
"affected": [],
"aliases": [
"CVE-2026-52947"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T17:17:04Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove\n\nIn qrtr_port_remove(), the socket reference count is decremented via\n__sock_put() before the port is removed from the qrtr_ports XArray and\nbefore the RCU grace period elapses.\n\nThis breaks the fundamental RCU update paradigm. It exposes a race\nwindow where a concurrent RCU reader (such as qrtr_reset_ports() or\nqrtr_port_lookup()) can obtain a pointer to the socket from the XArray,\nand attempt to call sock_hold() on a socket whose reference count has\nalready dropped to zero.\n\nThis exact race condition was hit during syzkaller fuzzing, leading to\nthe following refcount saturation warning and a potential Use-After-Free:\n\n refcount_t: saturated; leaking memory.\n WARNING: CPU: 3 PID: 1273 at lib/refcount.c:22 refcount_warn_saturate+0xae/0x1d0\n Modules linked in: qrtr(+) bochs drm_shmem_helper ...\n Call Trace:\n \u003cTASK\u003e\n qrtr_reset_ports net/qrtr/af_qrtr.c:768 [inline] [qrtr]\n __qrtr_bind.isra.0+0x48b/0x570 net/qrtr/af_qrtr.c:805 [qrtr]\n qrtr_bind+0x17d/0x210 net/qrtr/af_qrtr.c:901 [qrtr]\n kernel_bind+0xe4/0x120 net/socket.c:3592\n qrtr_ns_init+0x1a6/0x380 net/qrtr/ns.c:715 [qrtr]\n qrtr_proto_init+0x3b/0xff0 net/qrtr/af_qrtr.c:169 [qrtr]\n do_one_initcall+0xf5/0x5e0 init/main.c:1283\n ...\n \u003c/TASK\u003e\n\nFix this by deferring the reference count decrement until after the\nxa_erase() and the synchronize_rcu() complete.\n\n(Note: The v1 of this patch incorrectly replaced __sock_put() with\nsock_put(). As Simon Horman pointed out, the callers of qrtr_port_remove()\nstill hold a reference to the socket, so freeing the socket memory here\nwould lead to a subsequent UAF in the caller. Thus, the __sock_put() is\nkept, but only repositioned to close the RCU race.)",
"id": "GHSA-49c8-7mpf-m266",
"modified": "2026-10-15T03:36:11Z",
"published": "2026-06-24T18:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52947"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/03bfa95e452e2b6ccd76a332060ae4feaf5ad84d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2047c2aa0963bb2872fd722300a15bcb441a4c00"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2aa4c12723fe432e623462a3be42a197a128722b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3b20ec8f31e8a6a6782243f473b0abd3463621df"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/474293d90880622fde9d2430fb0165767090f7b3"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7de2d447072be3b1a76793f034432338fc9c494b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a2171131ecda1ed61a594a1eb715e75fdad0fef5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ab269990ed58143a92a263be1bee626d82ac03da"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-49HH-3WXF-QHW8
Vulnerability from github – Published: 2026-07-18 09:32 – Updated: 2026-07-18 09:32A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label "not planned" by a bot.
{
"affected": [],
"aliases": [
"CVE-2026-16082"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-18T09:17:07Z",
"severity": "LOW"
},
"details": "A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carried out locally. The exploit is publicly available and might be used. The reported GitHub issue was closed automatically with the label \"not planned\" by a bot.",
"id": "GHSA-49hh-3wxf-qhw8",
"modified": "2026-07-18T09:32:17Z",
"published": "2026-07-18T09:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16082"
},
{
"type": "WEB",
"url": "https://github.com/sipeed/picoclaw/issues/3081"
},
{
"type": "WEB",
"url": "https://github.com/sipeed/picoclaw"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16082"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/852944"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379794"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379794/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-49J8-C4PR-24H9
Vulnerability from github – Published: 2022-05-17 05:24 – Updated: 2025-01-21 21:30** DISPUTED ** Race condition in Online Armor Premium 4.0.0.35 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.
{
"affected": [],
"aliases": [
"CVE-2010-5169"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-08-25T21:55:00Z",
"severity": "MODERATE"
},
"details": "** DISPUTED ** Race condition in Online Armor Premium 4.0.0.35 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.",
"id": "GHSA-49j8-c4pr-24h9",
"modified": "2025-01-21T21:30:42Z",
"published": "2022-05-17T05:24:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5169"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
},
{
"type": "WEB",
"url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk"
},
{
"type": "WEB",
"url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
},
{
"type": "WEB",
"url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
},
{
"type": "WEB",
"url": "http://www.f-secure.com/weblog/archives/00001949.html"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/67660"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/39924"
},
{
"type": "WEB",
"url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-49WX-627V-6MCQ
Vulnerability from github – Published: 2022-04-29 01:28 – Updated: 2022-04-29 01:28sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.
{
"affected": [],
"aliases": [
"CVE-2003-1562"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2003-12-31T05:00:00Z",
"severity": "HIGH"
},
"details": "sshd in OpenSSH 3.6.1p2 and earlier, when PermitRootLogin is disabled and using PAM keyboard-interactive authentication, does not insert a delay after a root login attempt with the correct password, which makes it easier for remote attackers to use timing differences to determine if the password step of a multi-step authentication is successful, a different vulnerability than CVE-2003-0190.",
"id": "GHSA-49wx-627v-6mcq",
"modified": "2022-04-29T01:28:17Z",
"published": "2022-04-29T01:28:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1562"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=248747"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/320153"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/320302"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/320440"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/7482"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4C2X-G299-MPV8
Vulnerability from github – Published: 2022-05-13 01:41 – Updated: 2025-04-20 03:38Todd Miller's sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.
{
"affected": [],
"aliases": [
"CVE-2017-1000367"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-05T14:29:00Z",
"severity": "MODERATE"
},
"details": "Todd Miller\u0027s sudo version 1.8.20 and earlier is vulnerable to an input validation (embedded spaces) in the get_process_ttyname() function resulting in information disclosure and command execution.",
"id": "GHSA-4c2x-g299-mpv8",
"modified": "2025-04-20T03:38:27Z",
"published": "2022-05-13T01:41:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000367"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1381"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1382"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEXC4NNIG2QOZY6N2YUK246KI3D3UQO"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201705-15"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/42183"
},
{
"type": "WEB",
"url": "https://www.sudo.ws/alerts/linux_tty.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00077.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00078.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2017-05/msg00079.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/142783/Sudo-get_process_ttyname-Race-Condition.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Jun/3"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2017/dsa-3867"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/05/30/16"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/12/22/5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/12/22/6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98745"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038582"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3304-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4C32-X28M-P8H3
Vulnerability from github – Published: 2022-05-02 03:45 – Updated: 2022-05-02 03:45Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (crash) or gain privileges via vectors related to kqueues, which triggers a use after free, leading to a NULL pointer dereference or memory corruption.
{
"affected": [],
"aliases": [
"CVE-2009-3527"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-10-06T22:30:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 allows local users to cause a denial of service (crash) or gain privileges via vectors related to kqueues, which triggers a use after free, leading to a NULL pointer dereference or memory corruption.",
"id": "GHSA-4c32-x28m-p8h3",
"modified": "2022-05-02T03:45:58Z",
"published": "2022-05-02T03:45:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-3527"
},
{
"type": "WEB",
"url": "http://osvdb.org/58544"
},
{
"type": "WEB",
"url": "http://security.freebsd.org/advisories/FreeBSD-SA-09:13.pipe.asc"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/506449"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/36375"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1022982"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.