CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2921 vulnerabilities reference this CWE, most recent first.
GHSA-J6FW-387G-RW6J
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2026-50322"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T18:17:31Z",
"severity": "HIGH"
},
"details": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) in Windows Runtime allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-j6fw-387g-rw6j",
"modified": "2026-07-14T18:32:15Z",
"published": "2026-07-14T18:32:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50322"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50322"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6M4-FRXH-P4X8
Vulnerability from github – Published: 2022-05-17 05:44 – Updated: 2024-11-19 19:02Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0a2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "zodb3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.10.0a2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2010-3495"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-01T16:29:16Z",
"nvd_published_at": "2010-10-19T20:00:00Z",
"severity": "MODERATE"
},
"details": "Race condition in `ZEO/StorageServer.py` in Zope Object Database (ZODB) before 3.10.0a2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.",
"id": "GHSA-j6m4-frxh-p4x8",
"modified": "2024-11-19T19:02:36Z",
"published": "2022-05-17T05:44:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3495"
},
{
"type": "WEB",
"url": "https://github.com/zopefoundation/ZODB/commit/cfe16277ef1b5bb094dc79da50b0df1ee1537590"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/zodb/+bug/135108"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2010-27.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/ZODB3/3.10.0a2/#a2-2010-05-04"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20111225005929/http://secunia.com/advisories/41755"
},
{
"type": "WEB",
"url": "http://bugs.python.org/issue6706"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html"
},
{
"type": "WEB",
"url": "http://pypi.python.org/pypi/ZODB3/3.10.0#id1"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/41755"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/09/09/6"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/09/11/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/09/22/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/09/24/3"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Zope Object Database Denial of Service vulnerability"
}
GHSA-J6MR-2J2F-GXH9
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2024-02-16 21:31The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.
{
"affected": [],
"aliases": [
"CVE-2014-4699"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-07-09T11:07:00Z",
"severity": "MODERATE"
},
"details": "The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.",
"id": "GHSA-j6mr-2j2f-gxh9",
"modified": "2024-02-16T21:31:30Z",
"published": "2022-05-13T01:23:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4699"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1115927"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.47"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11"
},
{
"type": "WEB",
"url": "https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.97"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-0924.html"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-3047.html"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-3048.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/07/05/4"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/07/08/16"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/07/08/5"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/127573/Linux-Kernel-ptrace-sysret-Local-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59633"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59639"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59654"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60220"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60380"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/60393"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2972"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/34134"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/07/04/4"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/108754"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2266-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2267-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2268-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2269-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2270-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2271-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2272-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2273-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2274-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J6R2-Q88X-5M39
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2024-12-12 03:33Windows Remote Desktop Services Remote Code Execution Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-49132"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-416"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:04:40Z",
"severity": "HIGH"
},
"details": "Windows Remote Desktop Services Remote Code Execution Vulnerability",
"id": "GHSA-j6r2-q88x-5m39",
"modified": "2024-12-12T03:33:05Z",
"published": "2024-12-12T03:33:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49132"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49132"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6X4-C8GH-G296
Vulnerability from github – Published: 2023-03-14 18:30 – Updated: 2023-03-14 18:30Windows Graphics Component Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-24861"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-14T17:15:00Z",
"severity": "HIGH"
},
"details": "Windows Graphics Component Elevation of Privilege Vulnerability",
"id": "GHSA-j6x4-c8gh-g296",
"modified": "2023-03-14T18:30:20Z",
"published": "2023-03-14T18:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-24861"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24861"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6XP-8WG9-2GF2
Vulnerability from github – Published: 2022-05-17 02:37 – Updated: 2022-05-17 02:37Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.
{
"affected": [],
"aliases": [
"CVE-2016-2812"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-04-30T17:59:00Z",
"severity": "HIGH"
},
"details": "Race condition in the get implementation in the ServiceWorkerManager class in the Service Worker subsystem in Mozilla Firefox before 46.0 allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.",
"id": "GHSA-j6xp-8wg9-2gf2",
"modified": "2022-05-17T02:37:36Z",
"published": "2022-05-17T02:37:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2812"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1261776"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201701-15"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2016-05/msg00038.html"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2016/mfsa2016-42.html"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035692"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2936-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2936-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2936-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J6XX-FW69-3F9G
Vulnerability from github – Published: 2022-05-17 05:04 – Updated: 2022-05-17 05:04Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card.
{
"affected": [],
"aliases": [
"CVE-2013-5147"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-09-19T10:28:00Z",
"severity": "LOW"
},
"details": "Passcode Lock in Apple iOS before 7 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging a race condition involving phone calls and ejection of a SIM card.",
"id": "GHSA-j6xx-fw69-3f9g",
"modified": "2022-05-17T05:04:01Z",
"published": "2022-05-17T05:04:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-5147"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/54886"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT5934"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-J737-8H5G-42G9
Vulnerability from github – Published: 2024-02-21 15:30 – Updated: 2024-06-03 18:55In the Linux kernel, the following vulnerability has been resolved:
tls: fix race between async notify and socket close
The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data.
Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization.
Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires.
{
"affected": [],
"aliases": [
"CVE-2024-26583"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-21T15:15:09Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix race between async notify and socket close\n\nThe submitting thread (one which called recvmsg/sendmsg)\nmay exit as soon as the async crypto handler calls complete()\nso any code past that point risks touching already freed data.\n\nTry to avoid the locking and extra flags altogether.\nHave the main thread hold an extra reference, this way\nwe can depend solely on the atomic ref counter for\nsynchronization.\n\nDon\u0027t futz with reiniting the completion, either, we are now\ntightly controlling when completion fires.",
"id": "GHSA-j737-8h5g-42g9",
"modified": "2024-06-03T18:55:49Z",
"published": "2024-02-21T15:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26583"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6209319b2efdd8524691187ee99c40637558fa33"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7a3ca06d04d589deec81f56229a9a9d62352ce01"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/86dc27ee36f558fe223dbdfbfcb6856247356f4a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/aec7961916f3f9e88766e2688992da6980f11b8d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f17d21ea73918ace8afb9c2d8e734dbf71c2c9d7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EZOU3745CWCDZ7EMKMXB2OEEIB5Q3IWM"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OX4EWCYDZRTOEMC2C6OF7ZACAP23SUB5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7CP-5J3G-7Q5W
Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-07-14 15:31In the Linux kernel, the following vulnerability has been resolved:
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
On arm64 server, we found folio that get from migration entry isn't locked in softleaf_to_folio(). This issue triggers when mTHP splitting and zap_nonpresent_ptes() races, and the root cause is lack of memory barrier in softleaf_to_folio(). The race is as follows:
CPU0 CPU1
deferred_split_scan() zap_nonpresent_ptes() lock folio split_folio() unmap_folio() change ptes to migration entries __split_folio_to_order() softleaf_to_folio() set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry)) smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio)) prep_compound_page() for tail pages
In __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages are visible before the tail page becomes non-compound. smp_wmb() should be paired with smp_rmb() in softleaf_to_folio(), which is missed. As a result, if zap_nonpresent_ptes() accesses migration entry that stores tail pfn, softleaf_to_folio() may see the updated compound_head of tail page before page->flags.
This issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio() because of the race between folio split and zap_nonpresent_ptes() leading to a folio incorrectly undergoing modification without a folio lock being held.
This is a BUG_ON() before commit 93976a20345b ("mm: eliminate further swapops predicates"), which in merged in v6.19-rc1.
To fix it, add missing smp_rmb() if the softleaf entry is migration entry in softleaf_to_folio() and softleaf_to_page().
[tujinjiang@huawei.com: update function name and comments]
{
"affected": [],
"aliases": [
"CVE-2026-31466"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-22T14:16:42Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/huge_memory: fix folio isn\u0027t locked in softleaf_to_folio()\n\nOn arm64 server, we found folio that get from migration entry isn\u0027t locked\nin softleaf_to_folio(). This issue triggers when mTHP splitting and\nzap_nonpresent_ptes() races, and the root cause is lack of memory barrier\nin softleaf_to_folio(). The race is as follows:\n\n\tCPU0 CPU1\n\ndeferred_split_scan() zap_nonpresent_ptes()\n lock folio\n split_folio()\n unmap_folio()\n change ptes to migration entries\n __split_folio_to_order() softleaf_to_folio()\n set flags(including PG_locked) for tail pages folio = pfn_folio(softleaf_to_pfn(entry))\n smp_wmb() VM_WARN_ON_ONCE(!folio_test_locked(folio))\n prep_compound_page() for tail pages\n\nIn __split_folio_to_order(), smp_wmb() guarantees page flags of tail pages\nare visible before the tail page becomes non-compound. smp_wmb() should\nbe paired with smp_rmb() in softleaf_to_folio(), which is missed. As a\nresult, if zap_nonpresent_ptes() accesses migration entry that stores tail\npfn, softleaf_to_folio() may see the updated compound_head of tail page\nbefore page-\u003eflags.\n\nThis issue will trigger VM_WARN_ON_ONCE() in pfn_swap_entry_folio()\nbecause of the race between folio split and zap_nonpresent_ptes()\nleading to a folio incorrectly undergoing modification without a folio\nlock being held.\n\nThis is a BUG_ON() before commit 93976a20345b (\"mm: eliminate further\nswapops predicates\"), which in merged in v6.19-rc1.\n\nTo fix it, add missing smp_rmb() if the softleaf entry is migration entry\nin softleaf_to_folio() and softleaf_to_page().\n\n[tujinjiang@huawei.com: update function name and comments]",
"id": "GHSA-j7cp-5j3g-7q5w",
"modified": "2026-07-14T15:31:52Z",
"published": "2026-04-22T15:31:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31466"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/426ee10711586617da869c8bb798214965337617"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4c5e7f0fcd592801c9cc18f29f80fbee84eb8669"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/722cfaf6b31d31123439e67b5deac6b1261a3dea"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7ad1997b9bc8032603df8f091761114479285769"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7ddcf4a245c1c5a91fdd9698757e3d95179ffe41"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/8bfb8414e9f2ce6f5f2f0e3d0da52f2d132128e7"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/b8c49ad888892ad7b77062b9c102b799a3e9b4f8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f1acf5887c2bbaf998dc3fe32c72b7a8b84a3ddd"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-J7JM-6Q5X-FFR4
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-12 18:30A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)'s privileged code, which is not sandboxed and runs with full root privileges.
This issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD.
As a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.
{
"affected": [],
"aliases": [
"CVE-2024-7589"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-364"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:44Z",
"severity": "HIGH"
},
"details": "A signal handler in sshd(8) may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds (120 by default). This signal handler executes in the context of the sshd(8)\u0027s privileged code, which is not sandboxed and runs with full root privileges.\n\nThis issue is another instance of the problem in CVE-2024-6387 addressed by FreeBSD-SA-24:04.openssh. The faulty code in this case is from the integration of blacklistd in OpenSSH in FreeBSD.\n\nAs a result of calling functions that are not async-signal-safe in the privileged sshd(8) context, a race condition exists that a determined attacker may be able to exploit to allow an unauthenticated remote code execution as root.",
"id": "GHSA-j7jm-6q5x-ffr4",
"modified": "2024-08-12T18:30:47Z",
"published": "2024-08-12T15:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7589"
},
{
"type": "WEB",
"url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:08.openssh.asc"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2006-5051"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-6387"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.