CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
3221 vulnerabilities reference this CWE, most recent first.
GHSA-3XR6-PM2J-P9QJ
Vulnerability from github – Published: 2024-08-21 00:30 – Updated: 2025-11-04 00:31In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: Always drain health in shutdown callback
There is no point in recovery during device shutdown. if health work started need to wait for it to avoid races and NULL pointer access.
Hence, drain health WQ on shutdown callback.
{
"affected": [],
"aliases": [
"CVE-2024-43866"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-21T00:15:05Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: Always drain health in shutdown callback\n\nThere is no point in recovery during device shutdown. if health\nwork started need to wait for it to avoid races and NULL pointer\naccess.\n\nHence, drain health WQ on shutdown callback.",
"id": "GHSA-3xr6-pm2j-p9qj",
"modified": "2025-11-04T00:31:17Z",
"published": "2024-08-21T00:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43866"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/1b75da22ed1e6171e261bc9265370162553d5393"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/5005e2e159b300c1b8c6820a1e13a62eb0127b9b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6048dec754554a1303d632be6042d3feb3295285"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/6b6c2ebd83f2bf97e8f221479372aaca97a4a9b2"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3XWX-CWRM-PVFJ
Vulnerability from github – Published: 2022-05-17 04:51 – Updated: 2025-04-12 12:31includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
{
"affected": [],
"aliases": [
"CVE-2014-2243"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-03-02T04:57:00Z",
"severity": "MODERATE"
},
"details": "includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.",
"id": "GHSA-3xwx-cwrm-pvfj",
"modified": "2025-04-12T12:31:00Z",
"published": "2022-05-17T04:51:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2243"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071136"
},
{
"type": "WEB",
"url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=61346"
},
{
"type": "WEB",
"url": "https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f%2Cn%2Cz"
},
{
"type": "WEB",
"url": "https://gerrit.wikimedia.org/r/#/q/I2a9e89120f7092015495e638c6fa9f67adc9b84f,n,z"
},
{
"type": "WEB",
"url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/02/28/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2014/03/01/2"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-423X-F92F-R5FM
Vulnerability from github – Published: 2022-05-24 19:13 – Updated: 2022-07-13 00:01Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.
{
"affected": [],
"aliases": [
"CVE-2021-28701"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-08T14:15:00Z",
"severity": "HIGH"
},
"details": "Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.",
"id": "GHSA-423x-f92f-r5fm",
"modified": "2022-07-13T00:01:15Z",
"published": "2022-05-24T19:13:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28701"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3HEHUIUWSSMCQGQY3GWX4J2SZGYP5W2Z"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CEHZLIR5DFYYQBH55AERWHLO54OFU42C"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L4MI3MQAPGILCLXBGQWPZHGE3ALSO4ZU"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-23"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4977"
},
{
"type": "WEB",
"url": "https://xenbits.xenproject.org/xsa/advisory-384.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/09/08/2"
},
{
"type": "WEB",
"url": "http://xenbits.xen.org/xsa/advisory-384.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4282-5W9G-6Q57
Vulnerability from github – Published: 2022-05-24 19:04 – Updated: 2022-05-24 19:04Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2020-8670"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-09T19:15:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.",
"id": "GHSA-4282-5w9g-6q57",
"modified": "2022-05-24T19:04:28Z",
"published": "2022-05-24T19:04:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8670"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210702-0002"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00463.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-42CJ-99W8-CP2P
Vulnerability from github – Published: 2026-08-20 17:26 – Updated: 2026-08-20 17:26Summary
go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span.
Introduced in commit: 8cddf30
Details
bridge/opentracing/bridge.go:80-85 adds extraBaggageItems map[string]string to bridgeSpan without a mutex or other synchronization primitive. bridge/opentracing/bridge.go:219-234 shows SetBaggageItem calling updateOtelContext, which lazily creates the map and writes s.extraBaggageItems[restrictedKey] = value without locking. bridge/opentracing/bridge.go:359-377 shows correlationGetHook reading bSpan.extraBaggageItems, checking len(items), and iterating for k, v := range items without locking. The finding evidence also identifies api/correlation/context.go:160-165 as the path where correlation.MapFromContext invokes the get hook, allowing a read path to run concurrently with baggage writes.
Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can terminate the process with a runtime error such as fatal error: concurrent map read and map write or fatal error: concurrent map iteration and map write.
PoC
The validation artifact contains a PoC at validation-artifact.tar:validation_poc_concurrent_map.go and supporting notes at validation-artifact.tar:validation_poc_README.txt.
Use a checkout of pellared/opentelemetry-go at commit 8cddf30 with Go module downloads enabled. The local validation environment could not complete the run because GOPROXY=off blocked dependency resolution; that blocked output is saved in validation-artifact.tar:validation_poc_run.log.
Commands:
cd /path/to/opentelemetry-go
git checkout 8cddf30
tar -xOf /path/to/finding-directory/validation-artifact.tar validation_poc_concurrent_map.go > ./validation_poc_concurrent_map.go
GOPROXY=https://proxy.golang.org,direct go run ./validation_poc_concurrent_map.go
The PoC starts a BridgeTracer, creates a span, installs correlation hooks with tracer.NewHookedContext(ctx), initializes baggage once, then runs one goroutine repeatedly calling span.SetBaggageItem(...) while another repeatedly calls otelcorrelation.MapFromContext(ctx). A vulnerable build is expected to terminate with a Go runtime concurrent map access error, for example:
fatal error: concurrent map read and map write
or:
fatal error: concurrent map iteration and map write
Impact
This is a race condition / improper synchronization vulnerability in a shared Go map. Applications using the OpenTelemetry OpenTracing bridge with correlation hooks can crash if the same bridgeSpan is accessed concurrently, with one execution path setting baggage and another propagating correlation baggage. The practical impact is denial of service for the affected application process; exposure depends on whether application request handling or internal concurrency can trigger those operations on the same span.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "go.opentelemetry.io/otel/bridge/opentracing"
},
"ranges": [
{
"events": [
{
"introduced": "0.11.0"
},
{
"fixed": "1.45.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-45404"
],
"database_specific": {
"cwe_ids": [
"CWE-362",
"CWE-667"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-20T17:26:14Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\n`go.opentelemetry.io/otel/bridge/opentracing` introduced an unsynchronized `extraBaggageItems` map on `bridgeSpan`. One goroutine can write this map through `Span.SetBaggageItem` while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go\u0027s fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span.\n\nIntroduced in commit: 8cddf30\n\n### Details\n\n`bridge/opentracing/bridge.go:80-85` adds `extraBaggageItems map[string]string` to `bridgeSpan` without a mutex or other synchronization primitive. `bridge/opentracing/bridge.go:219-234` shows `SetBaggageItem` calling `updateOtelContext`, which lazily creates the map and writes `s.extraBaggageItems[restrictedKey] = value` without locking. `bridge/opentracing/bridge.go:359-377` shows `correlationGetHook` reading `bSpan.extraBaggageItems`, checking `len(items)`, and iterating `for k, v := range items` without locking. The finding evidence also identifies `api/correlation/context.go:160-165` as the path where `correlation.MapFromContext` invokes the get hook, allowing a read path to run concurrently with baggage writes.\n\nBecause Go maps are not safe for concurrent read/write access, concurrent `SetBaggageItem` and `correlation.MapFromContext` calls on the same hooked `bridgeSpan` can terminate the process with a runtime error such as `fatal error: concurrent map read and map write` or `fatal error: concurrent map iteration and map write`.\n\n### PoC\n\n[validation-artifact.zip](https://github.com/user-attachments/files/27494614/validation-artifact.zip)\n\n\nThe validation artifact contains a PoC at `validation-artifact.tar:validation_poc_concurrent_map.go` and supporting notes at `validation-artifact.tar:validation_poc_README.txt`.\n\nUse a checkout of `pellared/opentelemetry-go` at commit `8cddf30` with Go module downloads enabled. The local validation environment could not complete the run because `GOPROXY=off` blocked dependency resolution; that blocked output is saved in `validation-artifact.tar:validation_poc_run.log`.\n\nCommands:\n\n```sh\ncd /path/to/opentelemetry-go\ngit checkout 8cddf30\ntar -xOf /path/to/finding-directory/validation-artifact.tar validation_poc_concurrent_map.go \u003e ./validation_poc_concurrent_map.go\nGOPROXY=https://proxy.golang.org,direct go run ./validation_poc_concurrent_map.go\n```\n\nThe PoC starts a `BridgeTracer`, creates a span, installs correlation hooks with `tracer.NewHookedContext(ctx)`, initializes baggage once, then runs one goroutine repeatedly calling `span.SetBaggageItem(...)` while another repeatedly calls `otelcorrelation.MapFromContext(ctx)`. A vulnerable build is expected to terminate with a Go runtime concurrent map access error, for example:\n\n```text\nfatal error: concurrent map read and map write\n```\n\nor:\n\n```text\nfatal error: concurrent map iteration and map write\n```\n\n\n### Impact\n\nThis is a race condition / improper synchronization vulnerability in a shared Go map. Applications using the OpenTelemetry OpenTracing bridge with correlation hooks can crash if the same `bridgeSpan` is accessed concurrently, with one execution path setting baggage and another propagating correlation baggage. The practical impact is denial of service for the affected application process; exposure depends on whether application request handling or internal concurrency can trigger those operations on the same span.",
"id": "GHSA-42cj-99w8-cp2p",
"modified": "2026-08-20T17:26:14Z",
"published": "2026-08-20T17:26:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p"
},
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-go/pull/8693"
},
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-telemetry/opentelemetry-go"
},
{
"type": "WEB",
"url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access"
}
GHSA-42PJ-35W6-4JWG
Vulnerability from github – Published: 2024-03-28 18:30 – Updated: 2025-11-04 21:31A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Sonoma 14.2. An app may be able to execute arbitrary code with kernel privileges.
{
"affected": [],
"aliases": [
"CVE-2023-42974"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-28T16:15:08Z",
"severity": "HIGH"
},
"details": "A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.7.2, macOS Ventura 13.6.3, iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3, macOS Sonoma 14.2. An app may be able to execute arbitrary code with kernel privileges.",
"id": "GHSA-42pj-35w6-4jwg",
"modified": "2025-11-04T21:31:23Z",
"published": "2024-03-28T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42974"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214034"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214035"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214036"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214037"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214038"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214036"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214037"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214038"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-42X2-F5XM-RG4H
Vulnerability from github – Published: 2022-05-02 00:08 – Updated: 2022-05-02 00:08Race condition in the Passcode Lock feature in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.0 through 2.1 allows physically proximate attackers to remove the lock and launch arbitrary applications by restoring the device from a backup.
{
"affected": [],
"aliases": [
"CVE-2008-4229"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-25T23:30:00Z",
"severity": "LOW"
},
"details": "Race condition in the Passcode Lock feature in Apple iPhone OS 2.0 through 2.1 and iPhone OS for iPod touch 2.0 through 2.1 allows physically proximate attackers to remove the lock and launch arbitrary applications by restoring the device from a backup.",
"id": "GHSA-42x2-f5xm-rg4h",
"modified": "2022-05-02T00:08:06Z",
"published": "2022-05-02T00:08:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4229"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2008/Nov/msg00002.html"
},
{
"type": "WEB",
"url": "http://osvdb.org/50026"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32756"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3318"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32394"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1021271"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/3232"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-4348-X292-H437
Vulnerability from github – Published: 2022-12-28 00:30 – Updated: 2026-02-02 21:00Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-h2x7-2ff6-v32p. This link is maintained to preserve external references.
Original Description
A race condition can cause incorrect HTTP request routing.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/ntbosscher/gobase"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-30T18:04:09Z",
"nvd_published_at": "2022-12-27T22:15:00Z",
"severity": "LOW"
},
"details": "## Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-h2x7-2ff6-v32p. This link is maintained to preserve external references.\n\n## Original Description\nA race condition can cause incorrect HTTP request routing.",
"id": "GHSA-4348-x292-h437",
"modified": "2026-02-02T21:00:43Z",
"published": "2022-12-28T00:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2583"
},
{
"type": "WEB",
"url": "https://github.com/ntbosscher/gobase/commit/a8d40bce9c429d324122d18c446924dab809e812"
},
{
"type": "PACKAGE",
"url": "https://github.com/ntbosscher/gobase"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0400"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: GoBase Race Condition vulnerability",
"withdrawn": "2026-02-02T21:00:43Z"
}
GHSA-438P-QHHR-8GXM
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25Race condition in Google Chrome before 9.0.597.84 allows remote attackers to execute arbitrary code via vectors related to audio.
{
"affected": [],
"aliases": [
"CVE-2011-0784"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-02-04T18:00:00Z",
"severity": "MODERATE"
},
"details": "Race condition in Google Chrome before 9.0.597.84 allows remote attackers to execute arbitrary code via vectors related to audio.",
"id": "GHSA-438p-qhhr-8gxm",
"modified": "2022-05-13T01:25:52Z",
"published": "2022-05-13T01:25:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0784"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14108"
},
{
"type": "WEB",
"url": "http://code.google.com/p/chromium/issues/detail?id=69195"
},
{
"type": "WEB",
"url": "http://googlechromereleases.blogspot.com/2011/02/stable-channel-update.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-43FM-R495-G6GQ
Vulnerability from github – Published: 2022-05-24 17:17 – Updated: 2022-05-24 17:17The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an exploit chain, an attacker with access to the network can get root access on the gateway.
{
"affected": [],
"aliases": [
"CVE-2020-9475"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-05-07T21:15:00Z",
"severity": "MODERATE"
},
"details": "The S. Siedle \u0026 Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an exploit chain, an attacker with access to the network can get root access on the gateway.",
"id": "GHSA-43fm-r495-g6gq",
"modified": "2022-05-24T17:17:27Z",
"published": "2022-05-24T17:17:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9475"
},
{
"type": "WEB",
"url": "https://research.hisolutions.com/2020/04/open-the-gates-insecurity-of-cloudless-smart-door-systems"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.