Weakness (CWE)
CWE-662: Improper Synchronization
The product utilizes multiple threads, processes, components, or systems to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
More detail
Synchronization mechanisms vary widely, but they may include locking, mutexes, and semaphores.
How to prevent it (1 mitigation)
-
Implementation
Use industry standard APIs to synchronize your code.
Source: MITRE CWE-662
21 results · Clear filters · Feed
-
Medium 6.3
AdGuard Home: DoQ-to-UDP State Reduction and Source-Port Oracle
AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a quoted-port ICMP sou…
-
Medium 5.9
Axios HTTP/2 Session Cleanup State Corruption Vulnerability
Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent …
-
Medium 6.4
In adsp, there is a possible double free due to a race condition. This could lead to local escalation of privilege with…
-
Medium 6.4
In gpu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In display drm, there is a possible memory corruption due to a race condition. This could lead to local escalation of p…
-
Medium 6.4
In ccu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege…
-
Medium 6.4
In ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege…
-
Medium 6.4
In disp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege w…
-
Medium 6.4
In vow, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 6.4
In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege wi…
-
Medium 5.5
Deadlock in mutually recursive `tf.function` objects
TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock…
-
Medium 4.7
Data races in im
An issue was discovered in the im crate through 2020-11-09 for Rust. Because TreeFocus does not have bounds on its Send trait or Sync trait, a data race can occur.
-
Medium 5.9
Data races in multiqueue2
An issue was discovered in the multiqueue2 crate before 0.1.7 for Rust. Because a non-Send type can be sent to a different thread, a data race can occur.
-
Medium 5.9
Data race in eventio
An issue was discovered in Input<R> in the eventio crate before 0.5.1 for Rust. Because a non-Send type can be sent to a different thread, a data race and memory corruption can occur.
-
Medium 5.9
Data race in may_queue
An issue was discovered in the may_queue crate through 2020-11-10 for Rust. Because Queue does not have bounds on its Send trait or Sync trait, memory corruption can occur.
-
Medium 5.9
Improper synchronization in buttplug
An issue was discovered in the buttplug crate before 1.0.4 for Rust. ButtplugFutureStateShared does not properly consider (!Send|!Sync) objects, leading to a data race.
-
Medium 5.9
Data race in atomic-option
An issue was discovered in the atomic-option crate through 2020-10-31 for Rust. Because AtomicOption<T> implements Sync unconditionally, a data race can occur.
-
Medium 5.9
Data race in va-ts
An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
-
Medium 5.5
Data races in thex
An issue was discovered in the thex crate through 2020-12-08 for Rust. Thex<T> allows cross-thread data races of non-Send types.