Weakness (CWE)
CWE-662: Improper Synchronization
The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
More detail
Synchronization mechanisms vary widely, but they may include locking, mutexes, and semaphores.
How to prevent it (1 mitigation)
-
Implementation
Use industry standard APIs to synchronize your code.
Source: MITRE CWE-662
51 results · Feed
-
High 8.2
net/sched: act_ct: preserve tc_skb_cb across defragmentation
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: preserve tc_skb_cb across defragmentation tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving and restoring skb->cb. The defrag helper clears IPCB/IP6CB…
-
High 7.8
wifi: cfg80211: use wiphy work for socket owner autodisconnect
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: use wiphy work for socket owner autodisconnect nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a…
-
High 8.4
fs: preserve ACL_DONT_CACHE state in forget_cached_acl()
In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACL_DONT_CACHE state in forget_cached_acl() The ACL_DONT_CACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Comm…
-
High 7.1
drm/amdgpu: reject mapping a reserved doorbell to a new queue
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. Howev…
-
High 7.8
perf/core: Detach event groups during remove_on_exec
In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, this removes the event from the conte…
-
High 7.5
crypto: pcrypt - restore callback for non-parallel fallback
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcrypt_aead_done() on the child AEAD request before trying to submit it through padata. If padata_do_parallel() ret…
-
High 7.8
net/smc: Do not re-initialize smc hashtables
In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(), proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht bei…
-
High 8.8
wifi: mt76: add wcid publish check in mt76_sta_add
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: add wcid publish check in mt76_sta_add Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list. Found dev->sta_poll_…
-
Medium 6.3
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP sou…
-
Low 3.1
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of…
-
High 8.2
net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery In case of a TX error CQE, a recovery flow is triggered, mlx5e_reset_txqsq_cc_pc() resets dma_fifo_cc to 0 but not dma_fifo_pc, desynci…
-
High 8.1
smb: client: fix in-place encryption corruption in SMB2_write()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix in-place encryption corruption in SMB2_write() SMB2_write() places write payload in iov[1..n] as part of rq_iov. smb3_init_transform_rq() pointer-shares rq_iov, so crypt_mess…
-
High —
Mezo: ERC-20 bridgeOut burn can be erased by a stale StateDB overwrite leading to full L1 bridge drain
**Note: the fixed version of the validator client has been deployed for some time.** ### Impact Potential full drain of L1 bridge without changing bridged balance on Mezo. ## Brief/Intro A malicious user can steal all ERC-20 tokens locked in the L1 bridge by …
-
High 7.8
drm/xe: always keep track of remap prev/next
In the Linux kernel, the following vulnerability has been resolved: drm/xe: always keep track of remap prev/next During 3D workload, user is reporting hitting: [ 413.361679] WARNING: drivers/gpu/drm/xe/xe_vm.c:1217 at vm_bind_ioctl_ops_unwind+0x1e2/0x2e0 [xe]…
-
Medium 5.9
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent …
-
High 7.8
net: shaper: protect late read accesses to the hierarchy
In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take i…
-
High 7.5
OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized acce…
-
Critical 9.8
net/handshake: duplicate handshake cancellations leak socket
In the Linux kernel, the following vulnerability has been resolved: net/handshake: duplicate handshake cancellations leak socket When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the hands…
-
Low 2.3
Improper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escala…
-
Low 2.3
double eval in For List Iter in Vyper
vyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loo…
-
High 7.5
Qemu: denial of service via improper synchronization in qemu nbd server during socket closure
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.
-
Critical 9.1
Evmos' transaction execution not accounting for all state transition after interaction with precompiles
Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with Ethereum. Prior to 17.0.0, there is a way to mint arbitrary tokens due to the possibility to have two different states not in sync during the ex…
-
High 7.5
Grafana Missing Synchronization vulnerability
Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mi…
-
Medium 6.4
In adsp, there is a possible double free due to a race condition. This could lead to local escalation of privilege with…
-
Medium 6.4
In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of p…
-
Medium 6.4
In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege…
-
Medium 6.4
In ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege…
-
Medium 6.4
In disp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege w…
-
Medium 6.4
In vow, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Low 2.6
Improper Synchronization in Jenkins Convertigo Mobile Platform Plugin
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier uses static fields to store job configuration information, allowing attackers with Item/Configure permission to capture passwords of the jobs that will be configured.
-
Medium 5.5
Deadlock in mutually recursive `tf.function` objects
TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock…
-
Medium 4.7
Data races in im
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
-
High 7.0
Data races in rusb
An issue was discovered in the rusb crate before 0.7.0 for Rust. Because of a lack of Send and Sync bounds, a data race and memory corruption can occur.
-
High 7.0
Data races in aovec
An issue was discovered in the aovec crate through 2020-12-10 for Rust. Because Aovec<T> does not have bounds on its Send trait or Sync trait, a data race and memory corruption can occur.
-
High 7.8
Data races in conquer-once
An issue was discovered in the conquer-once crate before 0.3.2 for Rust. Thread crossing can occur for a non-Send but Sync type, leading to memory corruption.
-
High 7.0
Data races in late-static
An issue was discovered in the late-static crate before 0.4.0 for Rust. Because Sync is implemented for LateStatic with T: Send, a data race can occur.