Weakness (CWE)
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
How to prevent it (8 mitigations)
-
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
-
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
-
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
-
Implementation
When using multithreading and operating on shared variables, only use thread-safe functions.
-
Implementation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
-
Implementation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
-
Implementation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
-
Implementation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Source: MITRE CWE-362
867 results · Clear filters · Feed
-
High 7.8
Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Win32k Elevation of Privilege Vulnerability
Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Overlay Filter Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
-
High 8.1
Windows Internet Information Services Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Audio Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Client for NFS Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Message Queuing Elevation of Privilege Vulnerability
Use after free in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Management Instrumentation Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior. A locally authenticated attacker could run arbitrary code with elevated system…
-
High 7.0
Volume Shadow Copy Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Volume Shadow Copy allows an authorized attacker to elevate privileges locally.
-
High 7.5
ASP.NET Core Security Feature Bypass Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in ASP.NET Core allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability
Use after free in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server Network Transport Driver (srvnet.sys) allows an authorized attacker to execute code over a network.
-
High 7.0
Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Fast FAT Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Fast FAT Driver allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows DWM Core Library Elevation of Privilege Vulnerability
No cwe for this issue in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Print Spooler Components Elevation of Privilege Vulnerability
Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
-
High 7.5
Windows Event Collector Service Elevation of Privilege Vulnerability
Use after free in Windows Event Collector Service allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Feedback Hub Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.0
Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability
Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Diagnostic Policy Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Broadcast DVR User Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Kernel Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability
Use of uninitialized resource in Microsoft ActiveX Installer Service allows an authorized attacker to elevate privileges locally.
-
High 7.0
vhdmp.sys Elevation of Privilege Vulnerability
Use after free in vhdmp.sys allows an authorized attacker to elevate privileges locally.
-
High 7.5
Remote Desktop Client Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Graphics Kernel Elevation of Privilege Vulnerability
Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Local Security Authority Subsystem Service (LSASS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Error Reporting Elevation of Privilege Vulnerability
Double free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.