CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2963 vulnerabilities reference this CWE, most recent first.
GHSA-XWH9-GC39-5298
Vulnerability from github – Published: 2023-11-28 17:36 – Updated: 2024-05-20 21:58A race condition in go-resty can result in HTTP request body disclosure across requests.
This condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn't had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.
The sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-resty/resty/v2"
},
"ranges": [
{
"events": [
{
"introduced": "2.10.0"
},
{
"fixed": "2.11.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45286"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2023-11-28T17:36:21Z",
"nvd_published_at": "2023-11-28T17:15:08Z",
"severity": "MODERATE"
},
"details": "A race condition in go-resty can result in HTTP request body disclosure across requests.\n\nThis condition can be triggered by calling sync.Pool.Put with the same *bytes.Buffer more than once, when request retries are enabled and a retry occurs. The call to sync.Pool.Get will then return a bytes.Buffer that hasn\u0027t had bytes.Buffer.Reset called on it. This dirty buffer will contain the HTTP request body from an unrelated request, and go-resty will append the current HTTP request body to it, sending two bodies in one request.\n\nThe sync.Pool in question is defined at package level scope, so a completely unrelated server could receive the request body.",
"id": "GHSA-xwh9-gc39-5298",
"modified": "2024-05-20T21:58:12Z",
"published": "2023-11-28T17:36:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45286"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/issues/739"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/issues/743"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/pull/745"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/commit/577fed8730d79f583eb48dfc81674164e1fc471e"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-resty/resty"
},
{
"type": "WEB",
"url": "https://github.com/go-resty/resty/releases/tag/v2.11.0"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2023-2328"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "github.com/go-resty/resty/v2 HTTP request body disclosure"
}
GHSA-XWJP-HC68-95RC
Vulnerability from github – Published: 2022-05-17 05:24 – Updated: 2024-07-03 18:31** DISPUTED ** Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.
{
"affected": [],
"aliases": [
"CVE-2010-5175"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2012-08-25T21:55:00Z",
"severity": "MODERATE"
},
"details": "** DISPUTED ** Race condition in PrivateFirewall 7.0.20.37 on Windows XP allows local users to bypass kernel-mode hook handlers, and execute dangerous code that would otherwise be blocked by a handler but not blocked by signature-based malware detection, via certain user-space memory changes during hook-handler execution, aka an argument-switch attack or a KHOBE attack. NOTE: this issue is disputed by some third parties because it is a flaw in a protection mechanism for situations where a crafted program has already begun to execute.",
"id": "GHSA-xwjp-hc68-95rc",
"modified": "2024-07-03T18:31:17Z",
"published": "2022-05-17T05:24:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5175"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2010-05/0026.html"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0066.html"
},
{
"type": "WEB",
"url": "http://countermeasures.trendmicro.eu/you-just-cant-trust-a-drunk"
},
{
"type": "WEB",
"url": "http://matousec.com/info/advisories/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
},
{
"type": "WEB",
"url": "http://matousec.com/info/articles/khobe-8.0-earthquake-for-windows-desktop-security-software.php"
},
{
"type": "WEB",
"url": "http://www.f-secure.com/weblog/archives/00001949.html"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/67660"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/39924"
},
{
"type": "WEB",
"url": "http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XWPG-VM43-3QWM
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2025-10-22 03:30The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
{
"affected": [],
"aliases": [
"CVE-2014-0196"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-05-07T10:55:00Z",
"severity": "MODERATE"
},
"details": "The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the \"LECHO \u0026 !OPOST\" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.",
"id": "GHSA-xwpg-vm43-3qwm",
"modified": "2025-10-22T03:30:37Z",
"published": "2022-05-13T01:23:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0196"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1094232"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0196"
},
{
"type": "WEB",
"url": "http://bugzilla.novell.com/show_bug.cgi?id=875690"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=4291086b1f081b869c6d79e5b7441633dc3ace00"
},
{
"type": "WEB",
"url": "http://linux.oracle.com/errata/ELSA-2014-0771.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.html"
},
{
"type": "WEB",
"url": "http://pastebin.com/raw.php?i=yTSFUBgZ"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0512.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59218"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59262"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/59599"
},
{
"type": "WEB",
"url": "http://source.android.com/security/bulletin/2016-07-01.html"
},
{
"type": "WEB",
"url": "http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2926"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2014/dsa-2928"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/33516"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2014/05/05/6"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/106646"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2196-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2197-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2198-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2199-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2200-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2201-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2202-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2203-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2204-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XWQG-3XFC-GP8V
Vulnerability from github – Published: 2023-01-11 00:30 – Updated: 2023-01-11 00:30Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability.
{
"affected": [],
"aliases": [
"CVE-2023-21771"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-10T22:15:00Z",
"severity": "HIGH"
},
"details": "Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability.",
"id": "GHSA-xwqg-3xfc-gp8v",
"modified": "2023-01-11T00:30:45Z",
"published": "2023-01-11T00:30:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21771"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21771"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21771"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XWVM-474M-8395
Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03Race condition in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors involving access to an object, aka "Window Open Race Condition Vulnerability."
{
"affected": [],
"aliases": [
"CVE-2011-1257"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-08-10T21:55:00Z",
"severity": "HIGH"
},
"details": "Race condition in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors involving access to an object, aka \"Window Open Race Condition Vulnerability.\"",
"id": "GHSA-xwvm-474m-8395",
"modified": "2022-05-13T01:03:28Z",
"published": "2022-05-13T01:03:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1257"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-057"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12787"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA11-221A.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XWXC-J97J-84GF
Vulnerability from github – Published: 2021-08-25 21:00 – Updated: 2023-06-13 20:35In the affected versions of this crate, LockWeak<T> unconditionally implemented Send with no trait bounds on T. LockWeak<T> doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "parc"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-09T17:05:10Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "In the affected versions of this crate, `LockWeak\u003cT\u003e` unconditionally implemented `Send` with no trait bounds on `T`. `LockWeak\u003cT\u003e` doesn\u0027t own `T` and only provides `\u0026T`. This allows concurrent access to a non-Sync `T`, which can cause undefined behavior like data races.\n",
"id": "GHSA-xwxc-j97j-84gf",
"modified": "2023-06-13T20:35:51Z",
"published": "2021-08-25T21:00:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/hyyking/rustracts/pull/6"
},
{
"type": "PACKAGE",
"url": "https://github.com/hyyking/rustracts/tree/master/parc"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2020-0134.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Race condition in Parc"
}
GHSA-XX59-PWX8-CV7Q
Vulnerability from github – Published: 2022-05-24 19:18 – Updated: 2022-05-24 19:18A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-005 Catalina. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.
{
"affected": [],
"aliases": [
"CVE-2020-29622"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-19T14:15:00Z",
"severity": "HIGH"
},
"details": "A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-005 Catalina. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.",
"id": "GHSA-xx59-pwx8-cv7q",
"modified": "2022-05-24T19:18:01Z",
"published": "2022-05-24T19:18:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-29622"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT212805"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XX6V-23GW-W7GQ
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2022-05-24 17:45A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-25158"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-30T02:15:00Z",
"severity": "MODERATE"
},
"details": "A remote arbitrary file read vulnerability was discovered in some Aruba Instant Access Point (IAP) products in version(s): Aruba Instant 6.5.x: 6.5.4.18 and below; Aruba Instant 8.3.x: 8.3.0.14 and below; Aruba Instant 8.5.x: 8.5.0.11 and below; Aruba Instant 8.6.x: 8.6.0.7 and below; Aruba Instant 8.7.x: 8.7.1.1 and below. Aruba has released patches for Aruba Instant that address this security vulnerability.",
"id": "GHSA-xx6v-23gw-w7gq",
"modified": "2022-05-24T17:45:49Z",
"published": "2022-05-24T17:45:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25158"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-723417.pdf"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-007.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/163522/Aruba-Instant-IAP-Remote-Code-Execution.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XX77-WHFM-M4QP
Vulnerability from github – Published: 2022-05-13 01:15 – Updated: 2022-05-13 01:15Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
{
"affected": [],
"aliases": [
"CVE-2013-1277"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-02-13T12:04:00Z",
"severity": "MODERATE"
},
"details": "Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.",
"id": "GHSA-xx77-whfm-m4qp",
"modified": "2022-05-13T01:15:47Z",
"published": "2022-05-13T01:15:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1277"
},
{
"type": "WEB",
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-016"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16256"
},
{
"type": "WEB",
"url": "http://www.us-cert.gov/cas/techalerts/TA13-043B.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-XX8X-HQ3H-F37H
Vulnerability from github – Published: 2026-06-18 15:32 – Updated: 2026-06-18 18:35HVM guest I/O port accesses are subject to either emulation or at least translation. Translations are managed by the device model (via XEN_DOMCTL_ioport_mapping), and hence the linked list used may changed at any time. Traversal of those lists (while handling guest I/O port accesses) therefore needs synchronizing with updates, which was missing so far.
{
"affected": [],
"aliases": [
"CVE-2026-42487"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-18T14:17:25Z",
"severity": "HIGH"
},
"details": "HVM guest I/O port accesses are subject to either emulation or at least\ntranslation. Translations are managed by the device model (via\nXEN_DOMCTL_ioport_mapping), and hence the linked list used may changed\nat any time. Traversal of those lists (while handling guest I/O port\naccesses) therefore needs synchronizing with updates, which was missing\nso far.",
"id": "GHSA-xx8x-hq3h-f37h",
"modified": "2026-06-18T18:35:20Z",
"published": "2026-06-18T15:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42487"
},
{
"type": "WEB",
"url": "https://xenbits.xenproject.org/xsa/advisory-491.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/06/09/11"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-491.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.