CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2895 vulnerabilities reference this CWE, most recent first.
GHSA-XWCX-VHR3-5QC7
Vulnerability from github – Published: 2022-05-17 03:28 – Updated: 2022-05-17 03:28Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization.
{
"affected": [],
"aliases": [
"CVE-2015-2706"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-04-27T11:59:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the AsyncPaintWaitEvent::AsyncPaintWaitEvent function in Mozilla Firefox before 37.0.2 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted plugin that does not properly complete initialization.",
"id": "GHSA-xwcx-vhr3-5qc7",
"modified": "2022-05-17T03:28:22Z",
"published": "2022-05-17T03:28:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2706"
},
{
"type": "WEB",
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1141081"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201512-10"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00044.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00046.html"
},
{
"type": "WEB",
"url": "http://www.mozilla.org/security/announce/2015/mfsa2015-45.html"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/74247"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032171"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2571-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XWGF-8969-9FM2
Vulnerability from github – Published: 2026-06-14 09:31 – Updated: 2026-07-06 18:30The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both." Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.
{
"affected": [],
"aliases": [
"CVE-2025-15546"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-14T08:16:17Z",
"severity": "MODERATE"
},
"details": "The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to \"maintain both.\" Due to a Time-of-Check to Time-of-Use (TOCTOU) race condition between the file existence check and the actual file write operation, an authenticated attacker can overwrite files uploaded by other users.",
"id": "GHSA-xwgf-8969-9fm2",
"modified": "2026-07-06T18:30:35Z",
"published": "2026-06-14T09:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15546"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/06e33418-1644-49a1-b012-122046604109"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XWH9-GC39-5298
Vulnerability from github – Published: 2023-11-28 17:36 – Updated: 2024-05-20 21:58A race condition in go-resty can result in HTTP request body disclosure across requests.
This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.
The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-resty/resty/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.10.0"
},
{
"fixed": "2.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45286"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2023-11-28T17:36:21Z",
"nvd_published_at": "2023-11-28T17:15:08Z",
"severity": "MODERATE"
},
"details": "A race condition in go-resty can result in HTTP request body disclosure across requests.\n\nThis condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn\u0027t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.\n\nThe sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.",
"id": "GHSA-xwh9-gc39-5298",
"modified": "2024-05-20T21:58:12Z",
"published": "2023-11-28T17:36:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45286"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/issues/739"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/issues/743"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/pull/745"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/commit/577fed8730d79f583eb48dfc81674164e1fc471e"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-resty/resty"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/releases/tag/v2.11.0"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2023-2328"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "github.com/go-resty/resty/v2 HTTP request body disclosure"
}
GHSA-XWJP-HC68-95RC
Vulnerability from github – Published: 2022-05-17 05:24 – Updated: 2024-07-03 18:31** DISPUTED ** Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.
{
"affected": [],
"aliases": [
"CVE-2010-5175"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-08-25T21:55:00Z",
"severity": "MODERATE"
},
"details": "** DISPUTED ** Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.",
"id": "GHSA-xwjp-hc68-95rc",
"modified": "2024-07-03T18:31:17Z",
"published": "2022-05-17T05:24:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5175"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
},
{
"type": "WEB",
"url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk"
},
{
"type": "WEB",
"url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
},
{
"type": "WEB",
"url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
},
{
"type": "WEB",
"url": "http://www.f-secure.com/weblog/archives/00001949.html"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/67660"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/39924"
},
{
"type": "WEB",
"url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XWPG-VM43-3QWM
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2025-10-22 03:30The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
{
"affected": [],
"aliases": [
"CVE-2014-0196"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-05-07T10:55:00Z",
"severity": "MODERATE"
},
"details": "The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the \"LECHO \u0026 !OPOST\" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.",
"id": "GHSA-xwpg-vm43-3qwm",
"modified": "2025-10-22T03:30:37Z",
"published": "2022-05-13T01:23:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0196"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1094232"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0196"
},
{
"type": "WEB",
"url": "http://bugzilla.novell.com/show_bug.cgi?id=875690"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4291086b1f081b869c6d79e5b7441633dc3ace00"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-0771.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.html"
},
{
"type": "WEB",
"url": "http://pastebin.com/raw.php?i=yTSFUBgZ"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0512.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59218"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59262"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59599"
},
{
"type": "WEB",
"url": "http://source.android.com/security/bulletin/2016-07-01.html"
},
{
"type": "WEB",
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2926"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2928"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/33516"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/05/05/6"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/106646"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2196-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2197-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2198-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2199-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2200-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2201-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2202-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2203-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2204-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XWQG-3XFC-GP8V
Vulnerability from github – Published: 2023-01-11 00:30 – Updated: 2023-01-11 00:30Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-21771"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-10T22:15:00Z",
"severity": "HIGH"
},
"details": "Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability.",
"id": "GHSA-xwqg-3xfc-gp8v",
"modified": "2023-01-11T00:30:45Z",
"published": "2023-01-11T00:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21771"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21771"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21771"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XWVM-474M-8395
Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03Race condition in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors involving access to an object, aka "Window Open Race Condition Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2011-1257"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-08-10T21:55:00Z",
"severity": "HIGH"
},
"details": "Race condition in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors involving access to an object, aka \"Window Open Race Condition Vulnerability.\"",
"id": "GHSA-xwvm-474m-8395",
"modified": "2022-05-13T01:03:28Z",
"published": "2022-05-13T01:03:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1257"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-057"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12787"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA11-221A.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XWXC-J97J-84GF
Vulnerability from github – Published: 2021-08-25 21:00 – Updated: 2023-06-13 20:35In the affected versions of this crate, LockWeak<T> unconditionally implemented Send with no trait bounds on T. LockWeak<T> doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "parc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-09T17:05:10Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "In the affected versions of this crate, `LockWeak\u003cT\u003e` unconditionally implemented `Send` with no trait bounds on `T`. `LockWeak\u003cT\u003e` doesn\u0027t own `T` and only provides `\u0026T`. This allows concurrent access to a non-Sync `T`, which can cause undefined behavior like data races.\n",
"id": "GHSA-xwxc-j97j-84gf",
"modified": "2023-06-13T20:35:51Z",
"published": "2021-08-25T21:00:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hyyking/rustracts/pull/6"
},
{
"type": "PACKAGE",
"url": "https://github.com/hyyking/rustracts/tree/master/parc"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0134.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Race condition in Parc"
}
GHSA-XX59-PWX8-CV7Q
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-005 Catalina. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.
{
"affected": [],
"aliases": [
"CVE-2020-29622"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-19T14:15:00Z",
"severity": "HIGH"
},
"details": "A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-005 Catalina. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.",
"id": "GHSA-xx59-pwx8-cv7q",
"modified": "2022-05-24T19:18:01Z",
"published": "2022-05-24T19:18:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29622"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT212805"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XX6V-23GW-W7GQ
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-25158"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-30T02:15:00Z",
"severity": "MODERATE"
},
"details": "A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.",
"id": "GHSA-xx6v-23gw-w7gq",
"modified": "2022-05-24T17:45:49Z",
"published": "2022-05-24T17:45:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25158"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.