Filtered by CWE-362
Filtered by vendor Subscriptions
Total 1909 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-47069 2 Linux, Redhat 6 Linux Kernel, Enterprise Linux, Rhel Aus and 3 more 2025-01-09 7.0 High
In the Linux kernel, the following vulnerability has been resolved: ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later call pipelined_send. This leads to a very hard to trigger race where a do_mq_timedreceive call might return and leave do_mq_timedsend to rely on an invalid address, causing the following crash: RIP: 0010:wake_q_add_safe+0x13/0x60 Call Trace: __x64_sys_mq_timedsend+0x2a9/0x490 do_syscall_64+0x80/0x680 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f5928e40343 The race occurs as: 1. do_mq_timedreceive calls wq_sleep with the address of `struct ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it holds a valid `struct ext_wait_queue *` as long as the stack has not been overwritten. 2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call __pipelined_op. 3. Sender calls __pipelined_op::smp_store_release(&this->state, STATE_READY). Here is where the race window begins. (`this` is `ewq_addr`.) 4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it will see `state == STATE_READY` and break. 5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive's stack. (Although the address may not get overwritten until another function happens to touch it, which means it can persist around for an indefinite time.) 6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a `struct ext_wait_queue *`, and uses it to find a task_struct to pass to the wake_q_add_safe call. In the lucky case where nothing has overwritten `ewq_addr` yet, `ewq_addr->task` is the right task_struct. In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a bogus address as the receiver's task_struct causing the crash. do_mq_timedsend::__pipelined_op() should not dereference `this` after setting STATE_READY, as the receiver counterpart is now free to return. Change __pipelined_op to call wake_q_add_safe on the receiver's task_struct returned by get_task_struct, instead of dereferencing `this` which sits on the receiver's stack. As Manfred pointed out, the race potentially also exists in ipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix those in the same way.
CVE-2023-29537 1 Mozilla 2 Firefox, Focus 2025-01-09 7.5 High
Multiple race conditions in the font initialization could have led to memory corruption and execution of attacker-controlled code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVE-2024-30046 2 Microsoft, Redhat 3 .net, Visual Studio 2022, Enterprise Linux 2025-01-08 5.9 Medium
Visual Studio Denial of Service Vulnerability
CVE-2023-6109 1 Yop-poll 1 Yop Poll 2025-01-08 5.3 Medium
The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the add() function. This makes it possible for unauthenticated attackers to place multiple votes on a single poll even when the poll is set to one vote per person.
CVE-2024-30031 1 Microsoft 16 Windows, Windows 10 1507, Windows 10 1607 and 13 more 2025-01-08 7.8 High
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
CVE-2023-20736 3 Google, Linuxfoundation, Mediatek 23 Android, Iot-yocto, Yocto and 20 more 2025-01-08 6.4 Medium
In vcu, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07645149; Issue ID: ALPS07645189.
CVE-2023-20750 2 Google, Mediatek 23 Android, Mt6835, Mt6886 and 20 more 2025-01-07 4.1 Medium
In swpm, there is a possible out of bounds write due to a race condition. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780926; Issue ID: ALPS07780928.
CVE-2023-52749 2 Linux, Redhat 3 Linux Kernel, Enterprise Linux, Rhel Eus 2025-01-06 4.7 Medium
In the Linux kernel, the following vulnerability has been resolved: spi: Fix null dereference on suspend A race condition exists where a synchronous (noqueue) transfer can be active during a system suspend. This can cause a null pointer dereference exception to occur when the system resumes. Example order of events leading to the exception: 1. spi_sync() calls __spi_transfer_message_noqueue() which sets ctlr->cur_msg 2. Spi transfer begins via spi_transfer_one_message() 3. System is suspended interrupting the transfer context 4. System is resumed 6. spi_controller_resume() calls spi_start_queue() which resets cur_msg to NULL 7. Spi transfer context resumes and spi_finalize_current_message() is called which dereferences cur_msg (which is now NULL) Wait for synchronous transfers to complete before suspending by acquiring the bus mutex and setting/checking a suspend flag.
CVE-2022-41035 1 Microsoft 1 Edge Chromium 2025-01-03 5.3 Medium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2022-38047 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2022-38029 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 7 High
Windows ALPC Elevation of Privilege Vulnerability
CVE-2022-38027 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 7 High
Windows Storage Elevation of Privilege Vulnerability
CVE-2022-38021 1 Microsoft 6 Windows 10, Windows 11, Windows Server 2012 and 3 more 2025-01-03 7 High
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
CVE-2022-38000 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2022-33634 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2022-30198 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2022-24504 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2022-22035 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2022-44669 1 Microsoft 4 Windows 10, Windows 11, Windows Server 2019 and 1 more 2025-01-03 7 High
Windows Error Reporting Elevation of Privilege Vulnerability
CVE-2022-44676 1 Microsoft 10 Windows 10, Windows 11, Windows 7 and 7 more 2025-01-03 8.1 High
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability