CWE-362
Allowed-with-ReviewConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Abstraction: Class · Status: Draft
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
2919 vulnerabilities reference this CWE, most recent first.
GHSA-GF35-GC84-4GF8
Vulnerability from github – Published: 2026-03-24 21:31 – Updated: 2026-03-24 21:31NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may lead to a denial of service.
{
"affected": [],
"aliases": [
"CVE-2025-33254"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-24T21:16:24Z",
"severity": "HIGH"
},
"details": "NVIDIA Triton Inference Server contains a vulnerability where an attacker may cause internal state corruption. A successful exploit of this vulnerability may lead to a denial of service.",
"id": "GHSA-gf35-gc84-4gf8",
"modified": "2026-03-24T21:31:24Z",
"published": "2026-03-24T21:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-33254"
},
{
"type": "WEB",
"url": "https://nvidia.custhelp.com/app/answers/detail/a_id/5790"
},
{
"type": "WEB",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-33254"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GF3Q-3Q8V-QPHC
Vulnerability from github – Published: 2022-05-17 04:54 – Updated: 2022-05-17 04:54Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact and attack vectors, involving the /var/tmp/libreswan-nss-pwd temporary file.
{
"affected": [],
"aliases": [
"CVE-2013-7283"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-01-09T18:07:00Z",
"severity": "HIGH"
},
"details": "Race condition in the libreswan.spec files for Red Hat Enterprise Linux (RHEL) and Fedora packages in libreswan 3.6 has unspecified impact and attack vectors, involving the /var/tmp/libreswan-nss-pwd temporary file.",
"id": "GHSA-gf3q-3q8v-qphc",
"modified": "2022-05-17T04:54:58Z",
"published": "2022-05-17T04:54:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7283"
},
{
"type": "WEB",
"url": "https://github.com/libreswan/libreswan/commit/ef2d756e73a188401c36133c2e2f7ce4f3c6ae55"
},
{
"type": "WEB",
"url": "https://lists.libreswan.org/pipermail/swan-announce/2013/000007.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/56276"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/101575"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GF9V-GRX3-GQG6
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2025-12-09 18:30Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2025-62469"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T18:15:59Z",
"severity": "HIGH"
},
"details": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-gf9v-grx3-gqg6",
"modified": "2025-12-09T18:30:46Z",
"published": "2025-12-09T18:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62469"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62469"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GFM6-QMCF-P3PC
Vulnerability from github – Published: 2023-06-06 15:30 – Updated: 2024-04-04 04:35In vcu, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645189.
{
"affected": [],
"aliases": [
"CVE-2023-20736"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-06T13:15:13Z",
"severity": "MODERATE"
},
"details": "In vcu, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645189.",
"id": "GHSA-gfm6-qmcf-p3pc",
"modified": "2024-04-04T04:35:28Z",
"published": "2023-06-06T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20736"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/June-2023"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GG5F-JPPF-GRP8
Vulnerability from github – Published: 2022-05-13 01:24 – Updated: 2025-04-11 03:39Race condition in the hvc_close function in drivers/char/hvc_console.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service or possibly have unspecified other impact by closing a Hypervisor Virtual Console device, related to the hvc_open and hvc_remove functions.
{
"affected": [],
"aliases": [
"CVE-2010-2653"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-10-05T18:00:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the hvc_close function in drivers/char/hvc_console.c in the Linux kernel before 2.6.34 allows local users to cause a denial of service or possibly have unspecified other impact by closing a Hypervisor Virtual Console device, related to the hvc_open and hvc_remove functions.",
"id": "GHSA-gg5f-jppf-grp8",
"modified": "2025-04-11T03:39:26Z",
"published": "2022-05-13T01:24:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2653"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=568621"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=320718ee074acce5ffced6506cb51af1388942aa"
},
{
"type": "WEB",
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=320718ee074acce5ffced6506cb51af1388942aa"
},
{
"type": "WEB",
"url": "http://lkml.org/lkml/2010/3/3/207"
},
{
"type": "WEB",
"url": "http://patchwork.kernel.org/patch/83353"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.34"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/03/04/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/04/17/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/04/18/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/04/19/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/04/19/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/07/01/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/07/06/7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/07/07/5"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GG6V-4QWX-RFPC
Vulnerability from github – Published: 2022-05-04 00:00 – Updated: 2022-05-12 00:01In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901.
{
"affected": [],
"aliases": [
"CVE-2022-20110"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-03T20:15:00Z",
"severity": "HIGH"
},
"details": "In ion, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901.",
"id": "GHSA-gg6v-4qwx-rfpc",
"modified": "2022-05-12T00:01:42Z",
"published": "2022-05-04T00:00:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20110"
},
{
"type": "WEB",
"url": "https://corp.mediatek.com/product-security-bulletin/May-2022"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GGF3-232M-5283
Vulnerability from github – Published: 2022-05-14 02:21 – Updated: 2022-05-14 02:21Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.
{
"affected": [],
"aliases": [
"CVE-2015-7990"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-12-28T11:59:00Z",
"severity": "MODERATE"
},
"details": "Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.",
"id": "GHSA-ggf3-232m-5283",
"modified": "2022-05-14T02:21:22Z",
"published": "2022-05-14T02:21:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7990"
},
{
"type": "WEB",
"url": "https://github.com/torvalds/linux/commit/8c7188b23474cca017b3ef354c4a58456f68303a"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1276437"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=952384"
},
{
"type": "WEB",
"url": "https://lkml.org/lkml/2015/10/16/530"
},
{
"type": "WEB",
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8c7188b23474cca017b3ef354c4a58456f68303a"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00039.html"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3396"
},
{
"type": "WEB",
"url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/10/27/5"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77340"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1034453"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2886-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2887-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2887-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2888-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2889-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2889-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2890-1"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2890-2"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2890-3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GGG7-H54G-WMQ5
Vulnerability from github – Published: 2025-09-17 15:30 – Updated: 2025-12-10 15:31In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Fix potential data race in rxrpc_wait_to_be_connected()
Inside the loop in rxrpc_wait_to_be_connected() it checks call->error to see if it should exit the loop without first checking the call state. This is probably safe as if call->error is set, the call is dead anyway, but we should probably wait for the call state to have been set to completion first, lest it cause surprise on the way out.
Fix this by only accessing call->error if the call is complete. We don't actually need to access the error inside the loop as we'll do that after.
This caused the following report:
BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_set_call_completion
write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1:
rxrpc_set_call_completion+0x71/0x1c0 net/rxrpc/call_state.c:22
rxrpc_send_data_packet+0xba9/0x1650 net/rxrpc/output.c:479
rxrpc_transmit_one+0x1e/0x130 net/rxrpc/output.c:714
rxrpc_decant_prepared_tx net/rxrpc/call_event.c:326 [inline]
rxrpc_transmit_some_data+0x496/0x600 net/rxrpc/call_event.c:350
rxrpc_input_call_event+0x564/0x1220 net/rxrpc/call_event.c:464
rxrpc_io_thread+0x307/0x1d80 net/rxrpc/io_thread.c:461
kthread+0x1ac/0x1e0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0:
rxrpc_send_data+0x29e/0x1950 net/rxrpc/sendmsg.c:296
rxrpc_do_sendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726
rxrpc_sendmsg+0x413/0x520 net/rxrpc/af_rxrpc.c:565
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg net/socket.c:747 [inline]
____sys_sendmsg+0x375/0x4c0 net/socket.c:2501
___sys_sendmsg net/socket.c:2555 [inline]
__sys_sendmmsg+0x263/0x500 net/socket.c:2641
__do_sys_sendmmsg net/socket.c:2670 [inline]
__se_sys_sendmmsg net/socket.c:2667 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x00000000 -> 0xffffffea
{
"affected": [],
"aliases": [
"CVE-2023-53345"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-17T15:15:38Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Fix potential data race in rxrpc_wait_to_be_connected()\n\nInside the loop in rxrpc_wait_to_be_connected() it checks call-\u003eerror to\nsee if it should exit the loop without first checking the call state. This\nis probably safe as if call-\u003eerror is set, the call is dead anyway, but we\nshould probably wait for the call state to have been set to completion\nfirst, lest it cause surprise on the way out.\n\nFix this by only accessing call-\u003eerror if the call is complete. We don\u0027t\nactually need to access the error inside the loop as we\u0027ll do that after.\n\nThis caused the following report:\n\n BUG: KCSAN: data-race in rxrpc_send_data / rxrpc_set_call_completion\n\n write to 0xffff888159cf3c50 of 4 bytes by task 25673 on cpu 1:\n rxrpc_set_call_completion+0x71/0x1c0 net/rxrpc/call_state.c:22\n rxrpc_send_data_packet+0xba9/0x1650 net/rxrpc/output.c:479\n rxrpc_transmit_one+0x1e/0x130 net/rxrpc/output.c:714\n rxrpc_decant_prepared_tx net/rxrpc/call_event.c:326 [inline]\n rxrpc_transmit_some_data+0x496/0x600 net/rxrpc/call_event.c:350\n rxrpc_input_call_event+0x564/0x1220 net/rxrpc/call_event.c:464\n rxrpc_io_thread+0x307/0x1d80 net/rxrpc/io_thread.c:461\n kthread+0x1ac/0x1e0 kernel/kthread.c:376\n ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n\n read to 0xffff888159cf3c50 of 4 bytes by task 25672 on cpu 0:\n rxrpc_send_data+0x29e/0x1950 net/rxrpc/sendmsg.c:296\n rxrpc_do_sendmsg+0xb7a/0xc20 net/rxrpc/sendmsg.c:726\n rxrpc_sendmsg+0x413/0x520 net/rxrpc/af_rxrpc.c:565\n sock_sendmsg_nosec net/socket.c:724 [inline]\n sock_sendmsg net/socket.c:747 [inline]\n ____sys_sendmsg+0x375/0x4c0 net/socket.c:2501\n ___sys_sendmsg net/socket.c:2555 [inline]\n __sys_sendmmsg+0x263/0x500 net/socket.c:2641\n __do_sys_sendmmsg net/socket.c:2670 [inline]\n __se_sys_sendmmsg net/socket.c:2667 [inline]\n __x64_sys_sendmmsg+0x57/0x60 net/socket.c:2667\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n value changed: 0x00000000 -\u003e 0xffffffea",
"id": "GHSA-ggg7-h54g-wmq5",
"modified": "2025-12-10T15:31:21Z",
"published": "2025-09-17T15:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-53345"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/2b5fdc0f5caa505afe34d608e2eefadadf2ee67a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3e8ba61a3fe4475a9b5c9fbfc664435c6795d872"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/454e48a9ff04c5fa1631bb172070fcb6389b97f9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GGVF-46PM-9CCW
Vulnerability from github – Published: 2022-05-17 02:53 – Updated: 2025-04-20 03:34Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
{
"affected": [],
"aliases": [
"CVE-2015-8556"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-24T14:59:00Z",
"severity": "CRITICAL"
},
"details": "Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.",
"id": "GHSA-ggvf-46pm-9ccw",
"modified": "2025-04-20T03:34:45Z",
"published": "2022-05-17T02:53:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8556"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201602-01"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/39010"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134948/Gentoo-QEMU-Local-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GH37-H7XR-7HJ2
Vulnerability from github – Published: 2024-09-04 21:30 – Updated: 2025-11-04 00:31In the Linux kernel, the following vulnerability has been resolved:
ALSA: line6: Fix racy access to midibuf
There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here).
This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.
{
"affected": [],
"aliases": [
"CVE-2024-44954"
],
"database_specific": {
"cwe_ids": [
"CWE-362"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T19:15:30Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: Fix racy access to midibuf\n\nThere can be concurrent accesses to line6 midibuf from both the URB\ncompletion callback and the rawmidi API access. This could be a cause\nof KMSAN warning triggered by syzkaller below (so put as reported-by\nhere).\n\nThis patch protects the midibuf call of the former code path with a\nspinlock for avoiding the possible races.",
"id": "GHSA-gh37-h7xr-7hj2",
"modified": "2025-11-04T00:31:20Z",
"published": "2024-09-04T21:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-44954"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Mitigation
Use thread-safe capabilities such as the data access abstraction in Spring.
Mitigation
- Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
- Additionally, this will minimize the amount of synchronization necessary and may even help to reduce the likelihood of a denial of service where an attacker may be able to repeatedly trigger a critical section (CWE-400).
Mitigation
When using multithreading and operating on shared variables, only use thread-safe functions.
Mitigation
Use atomic operations on shared variables. Be wary of innocent-looking constructs such as "x++". This may appear atomic at the code layer, but it is actually non-atomic at the instruction layer, since it involves a read, followed by a computation, followed by a write.
Mitigation
Use a mutex if available, but be sure to avoid related weaknesses such as CWE-412.
Mitigation
Avoid double-checked locking (CWE-609) and other implementation errors that arise when trying to avoid the overhead of synchronization.
Mitigation
Disable interrupts or signals over critical parts of the code, but also make sure that the code does not go into a large or infinite loop.
Mitigation
Use the volatile type modifier for critical variables to avoid unexpected compiler optimization or reordering. This does not necessarily solve the synchronization problem, but it can help.
Mitigation MIT-17
Strategy: Environment Hardening
Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
CAPEC-26: Leveraging Race Conditions
The adversary targets a race condition occurring when multiple processes access and manipulate the same resource concurrently, and the outcome of the execution depends on the particular order in which the access takes place. The adversary can leverage a race condition by "running the race", modifying the resource and modifying the normal execution flow. For instance, a race condition can occur while accessing a file: the adversary can trick the system by replacing the original file with their version and cause the system to read the malicious file.
CAPEC-29: Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
This attack targets a race condition occurring between the time of check (state) for a resource and the time of use of a resource. A typical example is file access. The adversary can leverage a file access race condition by "running the race", meaning that they would modify the resource between the first time the target program accesses the file and the time the target program uses the file. During that period of time, the adversary could replace or modify the file, causing the application to behave unexpectedly.