CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2921 vulnerabilities reference this CWE, most recent first.
GHSA-HXPW-4FHF-X5HX
Vulnerability from github – Published: 2026-05-01 15:30 – Updated: 2026-06-19 15:33In the Linux kernel, the following vulnerability has been resolved:
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
In tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points directly into the mmap'd TX ring buffer shared with userspace. The kernel validates the header via __packet_snd_vnet_parse() but then re-reads all fields later in virtio_net_hdr_to_skb(). A concurrent userspace thread can modify the vnet_hdr fields between validation and use, bypassing all safety checks.
The non-TPACKET path (packet_snd()) already correctly copies vnet_hdr to a stack-local variable. All other vnet_hdr consumers in the kernel (tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX path is the only caller of virtio_net_hdr_to_skb() that reads directly from user-controlled shared memory.
Fix this by copying vnet_hdr from the mmap'd ring buffer to a stack-local variable before validation and use, consistent with the approach used in packet_snd() and all other callers.
{
"affected": [],
"aliases": [
"CVE-2026-31700"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-01T14:16:19Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/packet: fix TOCTOU race on mmap\u0027d vnet_hdr in tpacket_snd()\n\nIn tpacket_snd(), when PACKET_VNET_HDR is enabled, vnet_hdr points\ndirectly into the mmap\u0027d TX ring buffer shared with userspace. The\nkernel validates the header via __packet_snd_vnet_parse() but then\nre-reads all fields later in virtio_net_hdr_to_skb(). A concurrent\nuserspace thread can modify the vnet_hdr fields between validation\nand use, bypassing all safety checks.\n\nThe non-TPACKET path (packet_snd()) already correctly copies vnet_hdr\nto a stack-local variable. All other vnet_hdr consumers in the kernel\n(tun.c, tap.c, virtio_net.c) also use stack copies. The TPACKET TX\npath is the only caller of virtio_net_hdr_to_skb() that reads directly\nfrom user-controlled shared memory.\n\nFix this by copying vnet_hdr from the mmap\u0027d ring buffer to a\nstack-local variable before validation and use, consistent with the\napproach used in packet_snd() and all other callers.",
"id": "GHSA-hxpw-4fhf-x5hx",
"modified": "2026-06-19T15:33:08Z",
"published": "2026-05-01T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31700"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f4c9754956b86de158a4af5278c5cf5bda9439e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1490f82353bdabc09265a74e645b07f05cf4188e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/28324a3b62d9ce7f9bdd65a8ce63f382041d1b27"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2c054e17d9d41f1020376806c7f750834ced4dc5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3a1bf9116ea31470b89692585c3910dfe830dcdd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/48a6ef291a17639e1b6ae0fbe9c8b2bb87d7804b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/714aa973da8163925eda7efd49361ccbee21ee46"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/74e2db36fe50e3ad9d5300d7fd0e6e2a15a6d121"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HXVM-5PXR-89R2
Vulnerability from github – Published: 2026-04-13 06:30 – Updated: 2026-04-13 06:30UAF vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.
{
"affected": [],
"aliases": [
"CVE-2026-34858"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-13T05:16:03Z",
"severity": "MODERATE"
},
"details": "UAF vulnerability in the communication module.\nImpact: Successful exploitation of this vulnerability may affect availability.",
"id": "GHSA-hxvm-5pxr-89r2",
"modified": "2026-04-13T06:30:31Z",
"published": "2026-04-13T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34858"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2026/4"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletinvision/2026/4"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletinwearables/2026/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HXW9-JXQW-JC8J
Vulnerability from github – Published: 2021-08-25 20:58 – Updated: 2021-08-24 18:21An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. This allows non-thread safe EntityStore and ComponentStores to be sent
across threads and cause data races.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "dces"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-36459"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-77"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-18T20:20:09Z",
"nvd_published_at": "2021-08-08T06:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in the dces crate through 2020-12-09 for Rust. The World type is marked as Send but lacks bounds on its EntityStore and ComponentStore. This allows non-thread safe `EntityStore` and `ComponentStore`s to be sent\nacross threads and cause data races.\n",
"id": "GHSA-hxw9-jxqw-jc8j",
"modified": "2021-08-24T18:21:21Z",
"published": "2021-08-25T20:58:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36459"
},
{
"type": "PACKAGE",
"url": "https://gitlab.redox-os.org/redox-os/dces-rust"
},
{
"type": "WEB",
"url": "https://gitlab.redox-os.org/redox-os/dces-rust/-/issues/8"
},
{
"type": "WEB",
"url": "https://raw.githubusercontent.com/rustsec/advisory-db/main/crates/dces/RUSTSEC-2020-0139.md"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0139.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Data races in dces"
}
GHSA-J23Q-3PH7-R326
Vulnerability from github – Published: 2022-05-17 05:11 – Updated: 2022-05-17 05:11Race condition in the CIFS implementation in the rewriter module in the Clientless SSL VPN component on Cisco Adaptive Security Appliances (ASA) devices allows remote authenticated users to cause a denial of service (device reload) by accessing resources within multiple sessions, aka Bug ID CSCub58996.
{
"affected": [],
"aliases": [
"CVE-2013-1199"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-04-18T18:55:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the CIFS implementation in the rewriter module in the Clientless SSL VPN component on Cisco Adaptive Security Appliances (ASA) devices allows remote authenticated users to cause a denial of service (device reload) by accessing resources within multiple sessions, aka Bug ID CSCub58996.",
"id": "GHSA-j23q-3ph7-r326",
"modified": "2022-05-17T05:11:14Z",
"published": "2022-05-17T05:11:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1199"
},
{
"type": "WEB",
"url": "http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1199"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J29F-XRW6-FM6C
Vulnerability from github – Published: 2024-07-29 15:30 – Updated: 2025-11-04 00:30In the Linux kernel, the following vulnerability has been resolved:
filelock: Fix fcntl/close race recovery compat path
When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies of the code I was patching: The normal version, and the version for 64-bit offsets on 32-bit kernels. Thanks to Greg KH for stumbling over this while doing the stable backport...
Apply exactly the same fix to the compat path for 32-bit kernels.
{
"affected": [],
"aliases": [
"CVE-2024-41020"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-29T14:15:03Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfilelock: Fix fcntl/close race recovery compat path\n\nWhen I wrote commit 3cad1bc01041 (\"filelock: Remove locks reliably when\nfcntl/close race is detected\"), I missed that there are two copies of the\ncode I was patching: The normal version, and the version for 64-bit offsets\non 32-bit kernels.\nThanks to Greg KH for stumbling over this while doing the stable\nbackport...\n\nApply exactly the same fix to the compat path for 32-bit kernels.",
"id": "GHSA-j29f-xrw6-fm6c",
"modified": "2025-11-04T00:30:59Z",
"published": "2024-07-29T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41020"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c43ad4ab41602201d34c66ac62130fe339d686f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/53e21cfa68a7d12de378b7116c75571f73e0dfa2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5b0af8e4c70e4b884bb94ff5f0cd49ecf1273c02"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/73ae349534ebc377328e7d21891e589626c6e82c"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/911cc83e56a2de5a40758766c6a70d6998248860"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a561145f3ae973ebf3e0aee41624e92a6c5cb38d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ed898f9ca3fa32c56c858b463ceb9d9936cc69c4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f4d0775c6e2f1340ca0725f0337de149aaa989ca"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f8138f2ad2f745b9a1c696a05b749eabe44337ea"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J2CV-H77G-5P95
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL < 3, the debug exception is delivered after the transfer to CPL < 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.
{
"affected": [],
"aliases": [
"CVE-2018-8897"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-08T18:29:00Z",
"severity": "HIGH"
},
"details": "A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer\u0027s Manual (SDM) was mishandled in the development of some or all operating-system kernels, resulting in unexpected behavior for #DB exceptions that are deferred by MOV SS or POP SS, as demonstrated by (for example) privilege escalation in Windows, macOS, some Xen configurations, or FreeBSD, or a Linux kernel crash. The MOV to SS and POP SS instructions inhibit interrupts (including NMIs), data breakpoints, and single step trap exceptions until the instruction boundary following the next instruction (SDM Vol. 3A; section 6.8.3). (The inhibited data breakpoints are those on memory accessed by the MOV to SS or POP to SS instruction itself.) Note that debug exceptions are not inhibited by the interrupt enable (EFLAGS.IF) system flag (SDM Vol. 3A; section 2.3). If the instruction following the MOV to SS or POP to SS instruction is an instruction like SYSCALL, SYSENTER, INT 3, etc. that transfers control to the operating system at CPL \u003c 3, the debug exception is delivered after the transfer to CPL \u003c 3 is complete. OS kernels may not expect this order of events and may therefore experience unexpected behavior when it occurs.",
"id": "GHSA-j2cv-h77g-5p95",
"modified": "2022-05-13T01:53:48Z",
"published": "2022-05-13T01:53:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8897"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/11/msg00013.html"
},
{
"type": "WEB",
"url": "https://patchwork.kernel.org/patch/10386677"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8897"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20180927-0002"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT208742"
},
{
"type": "WEB",
"url": "https://support.citrix.com/article/CTX234679"
},
{
"type": "WEB",
"url": "https://svnweb.freebsd.org/base?view=revision\u0026revision=333368"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3641-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3641-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4196"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4201"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/44697"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/45024"
},
{
"type": "WEB",
"url": "https://www.freebsd.org/security/advisories/FreeBSD-SA-18:06.debugreg.asc"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/631579"
},
{
"type": "WEB",
"url": "https://www.synology.com/support/security/Synology_SA_18_21"
},
{
"type": "WEB",
"url": "https://www.triplefault.io/2018/05/spurious-db-exceptions-with-pop-ss.html"
},
{
"type": "WEB",
"url": "https://xenbits.xen.org/xsa/advisory-260.html"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1318"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1319"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1345"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1346"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1347"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1348"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1349"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1350"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1351"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1352"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1353"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1354"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1355"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2018:1524"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1567074"
},
{
"type": "WEB",
"url": "https://github.com/can1357/CVE-2018-8897"
},
{
"type": "WEB",
"url": "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/05/msg00015.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/06/msg00000.html"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d8ba61ba58c88d5207c1ba2f7d9a2280e7d03be9"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2018/05/08/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2018/05/08/4"
},
{
"type": "WEB",
"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190921-01-debug-en"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104071"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040744"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040849"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040861"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040866"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1040882"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J2X4-J6JV-HPJV
Vulnerability from github – Published: 2026-05-12 18:30 – Updated: 2026-05-12 18:30Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-34345"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T18:17:09Z",
"severity": "HIGH"
},
"details": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-j2x4-j6jv-hpjv",
"modified": "2026-05-12T18:30:42Z",
"published": "2026-05-12T18:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34345"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34345"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J36C-G9G3-M3PH
Vulnerability from github – Published: 2022-05-13 01:02 – Updated: 2022-05-13 01:02Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.
{
"affected": [],
"aliases": [
"CVE-2017-5068"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-10-27T05:29:00Z",
"severity": "HIGH"
},
"details": "Incorrect handling of picture ID in WebRTC in Google Chrome prior to 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.",
"id": "GHSA-j36c-g9g3-m3ph",
"modified": "2022-05-13T01:02:41Z",
"published": "2022-05-13T01:02:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5068"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1228"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2017/05/stable-channel-update-for-desktop.html"
},
{
"type": "WEB",
"url": "https://crbug.com/679306"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201706-20"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/98288"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J3C5-JQHG-4V6J
Vulnerability from github – Published: 2023-09-04 03:30 – Updated: 2024-04-04 07:24In pda, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608514; Issue ID: ALPS07608514.
{
"affected": [],
"aliases": [
"CVE-2023-20834"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-04T03:15:10Z",
"severity": "MODERATE"
},
"details": "In pda, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07608514; Issue ID: ALPS07608514.",
"id": "GHSA-j3c5-jqhg-4v6j",
"modified": "2024-04-04T07:24:36Z",
"published": "2023-09-04T03:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20834"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/September-2023"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J3CW-XPXV-W9FR
Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2024-04-04 01:14GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.
{
"affected": [],
"aliases": [
"CVE-2018-19572"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-10T16:15:00Z",
"severity": "MODERATE"
},
"details": "GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1, 11.4.8, and 11.3.11.",
"id": "GHSA-j3cw-xpxv-w9fr",
"modified": "2024-04-04T01:14:15Z",
"published": "2022-05-24T16:49:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19572"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab-pages/issues/98"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.