CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2903 vulnerabilities reference this CWE, most recent first.
GHSA-RRH5-RFHQ-MFF2
Vulnerability from github – Published: 2024-10-21 18:30 – Updated: 2024-11-13 15:31In the Linux kernel, the following vulnerability has been resolved:
mm/gup: fix memfd_pin_folios alloc race panic
If memfd_pin_folios tries to create a hugetlb page, but someone else already did, then folio gets the value -EEXIST here:
folio = memfd_alloc_folio(memfd, start_idx);
if (IS_ERR(folio)) {
ret = PTR_ERR(folio);
if (ret != -EEXIST)
goto err;
then on the next trip through the "while start_idx" loop we panic here:
if (folio) {
folio_put(folio);
To fix, set the folio to NULL on error.
{
"affected": [],
"aliases": [
"CVE-2024-49872"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-21T18:15:08Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/gup: fix memfd_pin_folios alloc race panic\n\nIf memfd_pin_folios tries to create a hugetlb page, but someone else\nalready did, then folio gets the value -EEXIST here:\n\n folio = memfd_alloc_folio(memfd, start_idx);\n if (IS_ERR(folio)) {\n ret = PTR_ERR(folio);\n if (ret != -EEXIST)\n goto err;\n\nthen on the next trip through the \"while start_idx\" loop we panic here:\n\n if (folio) {\n folio_put(folio);\n\nTo fix, set the folio to NULL on error.",
"id": "GHSA-rrh5-rfhq-mff2",
"modified": "2024-11-13T15:31:36Z",
"published": "2024-10-21T18:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49872"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/ce645b9fdc78ec5d28067286e92871ddae6817d5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e28f39b359c0cfdcc011603e51187085a5f1e5e3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RRJ4-3RQR-76CQ
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-07-01 00:01A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.
{
"affected": [],
"aliases": [
"CVE-2021-28964"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-22T09:15:00Z",
"severity": "MODERATE"
},
"details": "A race condition was discovered in get_old_root in fs/btrfs/ctree.c in the Linux kernel through 5.11.8. It allows attackers to cause a denial of service (BUG) because of a lack of locking on an extent buffer before a cloning operation, aka CID-dbcc7d57bffc.",
"id": "GHSA-rrj4-3rqr-76cq",
"modified": "2022-07-01T00:01:06Z",
"published": "2022-05-24T17:45:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28964"
},
{
"type": "WEB",
"url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dbcc7d57bffc0c8cac9dac11bec548597d59a6a5"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00019.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00020.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210430-0003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RRM5-VQ26-9V4C
Vulnerability from github – Published: 2024-07-16 12:30 – Updated: 2025-09-25 21:30In the Linux kernel, the following vulnerability has been resolved:
can: isotp: fix potential CAN frame reception race in isotp_rcv()
When receiving a CAN frame the current code logic does not consider concurrently receiving processes which do not show up in real world usage.
Ziyang Xuan writes:
The following syz problem is one of the scenarios. so->rx.len is changed by isotp_rcv_ff() during isotp_rcv_cf(), so->rx.len equals 0 before alloc_skb() and equals 4096 after alloc_skb(). That will trigger skb_over_panic() in skb_put().
======================================================= CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0 RIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113 Call Trace: skb_over_panic net/core/skbuff.c:118 [inline] skb_put.cold+0x24/0x24 net/core/skbuff.c:1990 isotp_rcv_cf net/can/isotp.c:570 [inline] isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668 deliver net/can/af_can.c:574 [inline] can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635 can_receive+0x31d/0x580 net/can/af_can.c:665 can_rcv+0x120/0x1c0 net/can/af_can.c:696 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465 __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579
Therefore we make sure the state changes and data structures stay consistent at CAN frame reception time by adding a spin_lock in isotp_rcv(). This fixes the issue reported by syzkaller but does not affect real world operation.
{
"affected": [],
"aliases": [
"CVE-2022-48830"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-16T12:15:06Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncan: isotp: fix potential CAN frame reception race in isotp_rcv()\n\nWhen receiving a CAN frame the current code logic does not consider\nconcurrently receiving processes which do not show up in real world\nusage.\n\nZiyang Xuan writes:\n\nThe following syz problem is one of the scenarios. so-\u003erx.len is\nchanged by isotp_rcv_ff() during isotp_rcv_cf(), so-\u003erx.len equals\n0 before alloc_skb() and equals 4096 after alloc_skb(). That will\ntrigger skb_over_panic() in skb_put().\n\n=======================================================\nCPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc8-syzkaller #0\nRIP: 0010:skb_panic+0x16c/0x16e net/core/skbuff.c:113\nCall Trace:\n \u003cTASK\u003e\n skb_over_panic net/core/skbuff.c:118 [inline]\n skb_put.cold+0x24/0x24 net/core/skbuff.c:1990\n isotp_rcv_cf net/can/isotp.c:570 [inline]\n isotp_rcv+0xa38/0x1e30 net/can/isotp.c:668\n deliver net/can/af_can.c:574 [inline]\n can_rcv_filter+0x445/0x8d0 net/can/af_can.c:635\n can_receive+0x31d/0x580 net/can/af_can.c:665\n can_rcv+0x120/0x1c0 net/can/af_can.c:696\n __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5465\n __netif_receive_skb+0x24/0x1b0 net/core/dev.c:5579\n\nTherefore we make sure the state changes and data structures stay\nconsistent at CAN frame reception time by adding a spin_lock in\nisotp_rcv(). This fixes the issue reported by syzkaller but does not\naffect real world operation.",
"id": "GHSA-rrm5-vq26-9v4c",
"modified": "2025-09-25T21:30:19Z",
"published": "2024-07-16T12:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48830"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5b068f33bc8acfcfd5ea7992a2dafb30d89bad30"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7b53d2204ce79b27a878074a77d64f40ec21dbca"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7c759040c1dd03954f650f147ae7175476d51314"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/f90cc68f9f4b5d8585ad5d0a206a9d37ac299ef3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RV47-5VWQ-V454
Vulnerability from github – Published: 2022-05-01 23:49 – Updated: 2022-05-01 23:49Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent, related to "late ptrace_may_attach() check" and "race around &dead_engine_ops setting," a different vulnerability than CVE-2007-0771 and CVE-2008-1514. NOTE: this issue might only affect kernel versions before 2.6.16.x.
{
"affected": [],
"aliases": [
"CVE-2008-2365"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-06-30T21:41:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user\u0027s process that trigger a conflict between utrace_detach and report_quiescent, related to \"late ptrace_may_attach() check\" and \"race around \u0026dead_engine_ops setting,\" a different vulnerability than CVE-2007-0771 and CVE-2008-1514. NOTE: this issue might only affect kernel versions before 2.6.16.x.",
"id": "GHSA-rv47-5vwq-v454",
"modified": "2022-05-01T23:49:11Z",
"published": "2022-05-01T23:49:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2365"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=449359"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43567"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10749"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=5ecfbae093f0c37311e89b29bfc0c9d586eace87"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=f358166a9405e4f1d8e50d8f415c26d95505b6de"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git%3Ba=commit%3Bh=f5b40e363ad6041a96e3da32281d8faa191597b9"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commit;h=5ecfbae093f0c37311e89b29bfc0c9d586eace87"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commit;h=f358166a9405e4f1d8e50d8f415c26d95505b6de"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.25.y.git;a=commit;h=f5b40e363ad6041a96e3da32281d8faa191597b9"
},
{
"type": "WEB",
"url": "http://marc.info/?l=linux-kernel\u0026m=117863520707703\u0026w=2"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2008-0508.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30850"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31107"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3965"
},
{
"type": "WEB",
"url": "http://sources.redhat.com/cgi-bin/cvsweb.cgi/~checkout~/tests/ptrace-tests/tests/late-ptrace-may-attach-check.c?cvsroot=systemtap"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/06/26/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/07/14/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/29945"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1020362"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-625-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RV5X-972C-94H5
Vulnerability from github – Published: 2021-12-24 00:00 – Updated: 2022-01-13 00:02A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be able to gain elevated privileges.
{
"affected": [],
"aliases": [
"CVE-2017-13905"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-23T20:15:00Z",
"severity": "HIGH"
},
"details": "A race condition was addressed with additional validation. This issue is fixed in tvOS 11.2, iOS 11.2, macOS High Sierra 10.13.2, Security Update 2017-002 Sierra, and Security Update 2017-005 El Capitan, watchOS 4.2. An application may be able to gain elevated privileges.",
"id": "GHSA-rv5x-972c-94h5",
"modified": "2022-01-13T00:02:01Z",
"published": "2021-12-24T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-13905"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT208325"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT208327"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT208331"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT208334"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RV89-XJC2-9WP5
Vulnerability from github – Published: 2022-05-17 05:40 – Updated: 2022-05-17 05:40Race condition in IBM Web Content Manager (WCM) 7.0.0.1 before CF003 allows remote authenticated users to cause a denial of service (infinite recursive query) via unspecified vectors, related to a StackOverflowError exception.
{
"affected": [],
"aliases": [
"CVE-2010-4807"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-05-26T16:55:00Z",
"severity": "LOW"
},
"details": "Race condition in IBM Web Content Manager (WCM) 7.0.0.1 before CF003 allows remote authenticated users to cause a denial of service (infinite recursive query) via unspecified vectors, related to a StackOverflowError exception.",
"id": "GHSA-rv89-xjc2-9wp5",
"modified": "2022-05-17T05:40:16Z",
"published": "2022-05-17T05:40:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4807"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PM36141"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg24029452"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-RV9W-MXPP-HWHJ
Vulnerability from github – Published: 2022-03-04 00:00 – Updated: 2022-03-17 00:03.A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.
{
"affected": [],
"aliases": [
"CVE-2021-3609"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-03T19:15:00Z",
"severity": "HIGH"
},
"details": ".A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This race condition in net/can/bcm.c in the Linux kernel allows for local privilege escalation to root.",
"id": "GHSA-rv9w-mxpp-hwhj",
"modified": "2022-03-17T00:03:44Z",
"published": "2022-03-04T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3609"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/d5f9023fa61ee8b94f37a93f08e94b136cf1e463"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3044"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3057"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3088"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3235"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3363"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3375"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3380"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3442"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2021:3444"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2021-3609"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1971651"
},
{
"type": "WEB",
"url": "https://github.com/nrb547/kernel-exploitation/blob/main/cve-2021-3609/cve-2021-3609.md"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220419-0004"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2021/06/19/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RVJ4-Q8Q5-8GRF
Vulnerability from github – Published: 2024-06-20 16:20 – Updated: 2024-06-20 16:20Impact
There is a vulnerability in Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability.
References
Patches
- https://github.com/traefik/traefik/releases/tag/v2.11.5
- https://github.com/traefik/traefik/releases/tag/v3.0.3
Workarounds
No workaround.
For more information
If you have any questions or comments about this advisory, please open an issue.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.0.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.11.4"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-20T16:20:25Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Impact\n\nThere is a vulnerability in [Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability](https://nvd.nist.gov/vuln/detail/CVE-2024-35255).\n\n### References\n\n- [CVE-2024-35255](https://nvd.nist.gov/vuln/detail/CVE-2024-35255)\n\n### Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.5\n- https://github.com/traefik/traefik/releases/tag/v3.0.3\n\n### Workarounds\n\nNo workaround.\n\n### For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).",
"id": "GHSA-rvj4-q8q5-8grf",
"modified": "2024-06-20T16:20:25Z",
"published": "2024-06-20T16:20:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-rvj4-q8q5-8grf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35255"
},
{
"type": "PACKAGE",
"url": "https://github.com/traefik/traefik"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v2.11.5"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/releases/tag/v3.0.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ACME DNS: Azure Identity Libraries Elevation of Privilege Vulnerability"
}
GHSA-RVMF-QFPG-9QGJ
Vulnerability from github – Published: 2021-12-09 00:00 – Updated: 2022-07-13 00:01Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of authentication bypass by capture-replay, may allow a remote unauthenticated attacker to circumvent the authentication process and authenticate as a legitimate cluster peer.
{
"affected": [],
"aliases": [
"CVE-2021-41025"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-08T19:15:00Z",
"severity": "CRITICAL"
},
"details": "Multiple vulnerabilities in the authentication mechanism of confd in FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, 6.1.0 through 6.1.2, 6.0.0 thorugh 6.0.7, including an instance of concurrent execution using shared resource with improper synchronization and one of authentication bypass by capture-replay, may allow a remote unauthenticated attacker to circumvent the authentication process and authenticate as a legitimate cluster peer.",
"id": "GHSA-rvmf-qfpg-9qgj",
"modified": "2022-07-13T00:01:41Z",
"published": "2021-12-09T00:00:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41025"
},
{
"type": "WEB",
"url": "https://fortiguard.com/advisory/FG-IR-21-130"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RVQ6-RPM5-73FG
Vulnerability from github – Published: 2022-05-14 02:42 – Updated: 2022-05-14 02:42Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.
{
"affected": [],
"aliases": [
"CVE-2010-3864"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-11-17T16:00:00Z",
"severity": "HIGH"
},
"details": "Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o, 1.0.0, and 1.0.0a, when multi-threading and internal caching are enabled on a TLS server, might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow, related to (1) the TLS server name extension and (2) elliptic curve cryptography.",
"id": "GHSA-rvq6-rpm5-73fg",
"modified": "2022-05-14T02:42:51Z",
"published": "2022-05-14T02:42:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-3864"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2010:0888"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2010-3864"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=649304"
},
{
"type": "WEB",
"url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html"
},
{
"type": "WEB",
"url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2010-0888.html"
},
{
"type": "WEB",
"url": "http://blogs.sun.com/security/entry/cve_2010_3864_race_condition"
},
{
"type": "WEB",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02794777"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051170.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051237.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051255.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00006.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=129916880600544\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=130497251507577\u0026w=2"
},
{
"type": "WEB",
"url": "http://marc.info/?l=bugtraq\u0026m=132828103218869\u0026w=2"
},
{
"type": "WEB",
"url": "http://openssl.org/news/secadv_20101116.txt"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42241"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42243"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42309"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42336"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42352"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42397"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/42413"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43312"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/44269"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/57353"
},
{
"type": "WEB",
"url": "http://security.FreeBSD.org/advisories/FreeBSD-SA-10:10.openssl.asc"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1024743"
},
{
"type": "WEB",
"url": "http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2010\u0026m=slackware-security.668793"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT4723"
},
{
"type": "WEB",
"url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564"
},
{
"type": "WEB",
"url": "http://www.adobe.com/support/security/bulletins/apsb11-11.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2010/dsa-2125"
},
{
"type": "WEB",
"url": "http://www.kb.cert.org/vuls/id/737740"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3041"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3077"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3097"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/3121"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.