GitLab CE 8.17 and later and EE 8.3 and later have a symlink time-of-check-to-time-of-use race condition that would allow unauthorized access to files in the GitLab Pages chroot environment. This is fixed in versions 11.5.1 11.4.8 and 11.3.11.


An issue was discovered on Samsung mobile devices with L(5.x) M(6.0) and N(7.x) software. There is a race condition with a resultant double free in vnswap_init_backing_storage. The Samsung ID is SVE-2017-11177 (February 2018).


An issue was discovered on Samsung mobile devices with L(5.x) M(6.0) and N(7.x) software. There is a race condition with a resultant use-after-free in vnswap_deinit_backing_storage. The Samsung ID is SVE-2017-11176 (February 2018).


An issue was discovered on Samsung mobile devices with L(5.1) M(6.0) and N(7.x) software. There is a race condition with a resultant read-after-free issue in get_kek. The Samsung ID is SVE-2017-11174 (February 2018).


An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810 chipsets) software. There is a race condition with a resultant use-after-free in the g2d driver. The Samsung ID is SVE-2018-12959 (December 2018).


If an async request was completed by the application at the same time as the container triggered the async timeout a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.


screenresolution-mechanism in screen-resolution-extra 0.17.2 does not properly use the PolicyKit D-Bus API which allows local users to bypass intended access restrictions by leveraging a race condition via a setuid or pkexec process that is mishandled in a PolicyKitService._check_permission call.


An issue was discovered in the Linux kernel before 4.20. There is a race condition in smp_task_timedout() and smp_task_done() in drivers/scsi/libsas/sas_expander.c leading to a use-after-free.


In some Lenovo IdeaPad consumer notebook models a race condition in the BIOS flash device locking mechanism is not adequately protected against potentially allowing an attacker with administrator access to alter the contents of BIOS.


In

the

Linux

kernel

through

a

use-after-free

can

occur

due

to

a

race

condition

between

from

setsockopt

and

bind

on

an

socket.

This

issue

exists

because

of

the

incomplete

fix

for

a

race

condition.

The

code

mishandles

a

certain

multithreaded

case

involving

a

unregister

action

followed

by

a

register

action.

Later

operates

on

only

one

of

the

two

applicable

linked

lists.

The

attacker

can

achieve

Program

Counter

control.


An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However the user is left in that group if the command crashes and there is also a race condition in all cases.


private_address_check ruby gem before 0.5.0 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to the address the socket uses not being checked. DNS entries with a TTL of 0 can trigger this case where the initial resolution is a public address but the subsequent resolution is a private address.


Time-of-check to time-of-use (TOCTOU) race condition in org.onosproject.acl (aka the access control application) in ONOS v1.13 and earlier allows attackers to bypass network access control via data plane packet injection.


u'Error in UE due to race condition in EPCO handling' in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables in APQ8053 MDM9205 MDM9206 MSM8909W MSM8917 MSM8920 MSM8937 MSM8940 MSM8953 SDM450 SM8150


Johnathan Nightingale beep through 1.3.4 if setuid has a race condition that allows local privilege escalation.


While processing a packet decode request in MQTT Race condition can occur leading to an out-of-bounds access in snapdragon mobile and snapdragon wear in versions MDM9206 MDM9607 SD 210/SD 212/SD 205 SD 427 SD 435 SD 450 SD 625 SD 636 SD 835 SDA660 SDM630 SDM660 Snapdragon_High_Med_2016


In all android releases (Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel LUT configuration is passed down to driver from userspace via ioctl. Simultaneous update from userspace while kernel drivers are updating LUT registers can lead to race condition.


An issue was discovered in Joomla! Core before 3.8.8. A long running background process such as remote checks for core or extension updates could create a race condition where a session that was expected to be destroyed would be recreated.


procps-ng procps is vulnerable to a process hiding through race condition. Since the kernel's proc_pid_readdir() returns PID entries in ascending numeric order a process occupying a high PID can use inotify events to determine when the process list is being scanned and fork/exec to obtain a lower PID thus avoiding enumeration. An unprivileged attacker can hide a process from procps-ng's utilities by exploiting a race condition in reading /proc/PID entries. This vulnerability affects procps and procps-ng up to version 3.3.15 newer versions might be affected also.


A flaw was found in the Linux Kernel where an attacker may be able to have an uncontrolled read to kernel-memory from within a vm guest. A race condition between connect() and close() function may allow an attacker using the AF_VSOCK protocol to gather a 4 byte information leak or possibly intercept or corrupt AF_VSOCK messages destined to other clients.


In HTSlib 1.8 a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.


An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condition when accessing files a Use After Free condition can occur. This also affects all Android releases from CAF using the Linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-07-05.


A race condition exists in a driver in all Android releases from CAF using the Linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-05-05 potentially leading to a use-after-free condition.


Symantec Endpoint Protection prior to 14 RU1 MP1 or 12.1 RU6 MP10 may be susceptible to a race condition (or race hazard). This type of issue occurs in software where the output is dependent on the sequence or timing of other uncontrollable events.


Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel when more than one HLOS client loads the same TA a Use After Free condition can occur.


Due to a race condition in the MDSS MDP driver in all Android releases from CAF using the Linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-07-05 a Use After Free condition can occur.


Due to a race condition in a camera driver ioctl handler in Android releases from CAF using the linux kernel (Android for MSM Firefox OS for MSM QRD Android) before security patch level 2018-06-05 a Use After Free condition can occur.


An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the \Kernel\ component. A race condition allows attackers to bypass intended memory-read restrictions via a crafted app.


The svpn component of the F5 BIG-IP APM client prior to version 7.1.7.2 for Linux and macOS runs as a privileged process and can allow an unprivileged user to get ownership of files owned by root on the local client host in a race condition.


An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1 10.5.0 and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence the unprivileged user is able to perform a privilege escalation to delete arbitrary files.


An issue was discovered in secdrv.sys as shipped in Microsoft Windows Vista Windows 7 Windows 8 and Windows 8.1 before KB3086255 and as shipped in Macrovision SafeDisc. Two carefully timed calls to IOCTL 0xCA002813 can cause a race condition that leads to a use-after-free. When exploited an unprivileged attacker can run arbitrary code in the kernel.


A remote unauthorized disclosure of information vulnerability was identified in HPE Service Governance Framework (SGF) version 4.2 4.3. A race condition under high load in SGF exists where SGF transferred different parameter to the enabler.


Leptonica through 1.75.3 uses hardcoded /tmp pathnames which might allow local users to overwrite arbitrary files or have unspecified other impact by creating files in advance or winning a race condition as demonstrated by /tmp/junk_split_image.ps in prog/splitimage2pdf.c.


A race condition between permission prompts and navigations in Prompts in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


There is a race condition in OozieSharelibCLI in Apache Oozie before version 5.2.1 which allows a malicious attacker to replace the files in Oozie's sharelib during it's creation.


A flaw possibility of race condition and incorrect initialization of the process id was found in the Linux kernel child/parent process identification handling while filtering signal handlers. A local attacker is able to abuse this flaw to bypass checks to send any signal to a privileged process.


An issue was discovered in the internment crate through 2020-05-28 for Rust. ArcIntern::drop has a race condition and resultant use-after-free.


OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g. on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.


A Race Condition Enabling Link Following vulnerability in the cron job shipped with texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1 SUSE Linux Enterprise Software Development Kit 12-SP4 SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users in group mktex to delete arbitrary files on the system This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.


A Race Condition Enabling Link Following vulnerability in the packaging of texlive-filesystem of SUSE Linux Enterprise Module for Desktop Applications 15-SP1 SUSE Linux Enterprise Software Development Kit 12-SP4 SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local users to corrupt files or potentially escalate privileges. This issue affects: SUSE Linux Enterprise Module for Desktop Applications 15-SP1 texlive-filesystem versions prior to 2017.135-9.5.1. SUSE Linux Enterprise Software Development Kit 12-SP4 texlive-filesystem versions prior to 2013.74-16.5.1. SUSE Linux Enterprise Software Development Kit 12-SP5 texlive-filesystem versions prior to 2013.74-16.5.1. openSUSE Leap 15.1 texlive-filesystem versions prior to 2017.135-lp151.8.3.1.


Time-of-check Time-of-use Race Condition vulnerability on crash report ownership change in Apport allows for a possible privilege escalation opportunity. If fs.protected_symlinks is disabled this can be exploited between the os.open and os.chown calls when the Apport cron script clears out crash files of size 0. A symlink with the same name as the deleted file can then be created upon which chown will be called changing the file owner to root. Fixed in versions 2.20.1-0ubuntu2.23 2.20.9-0ubuntu7.14 2.20.11-0ubuntu8.8 and 2.20.11-0ubuntu22.


Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition.


The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows local privilege escalation via a race condition in logrotate. By using an exploit chain an attacker with access to the network can get root access on the gateway.


A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny an access request prior to unlocking the application with a PIN on older Android devices (effectively bypassing the PIN requirement).


Acrobat Reader DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a time-of-check time-of-use (TOCTOU) race condition vulnerability that could result in local privilege escalation. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


An issue was discovered in PowerDNS Authoritative through 4.3.0 when --enable-experimental-gss-tsig is used. A remote unauthenticated attacker can trigger a race condition leading to a crash or possibly arbitrary code execution by sending crafted queries with a GSS-TSIG signature.


In FreeBSD 13.0-STABLE before n245118 12.2-STABLE before r369552 11.4-STABLE before r369560 13.0-RC5 before p1 12.2-RELEASE before p6 and 11.4-RELEASE before p9 a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of \..\ and remounting a filesystem allowing access to filesystem hierarchy outside of the jail.


The Trend Micro Security 2020 (v16) consumer family of products is vulnerable to a security race condition arbitrary file deletion vulnerability that could allow an unprivileged user to manipulate the product's secure erase feature to delete files with a higher set of privileges.


An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct a situation where the same PID is used for running two different programs at different times by leveraging a race condition during crafted use of posix_spawn.


In FreeBSD 12.2-STABLE before r369312 11.4-STABLE before r369313 12.2-RELEASE before p4 and 11.4-RELEASE before p8 due to a race condition in the jail_remove(2) implementation it may fail to kill some of the processes.


Trend Micro Antivirus for Mac 2020 (Consumer) contains a race condition vulnerability in the Web Threat Protection Blocklist component that if exploited could allow an attacker to case a kernel panic or crash.\\n\\n\\r\\nAn attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.


A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled accessing their session without authentication. This is similar to CVE-2017-12164 but requires more difficult conditions to exploit.


Medtronic MyCareLink Smart 25000 all versions are vulnerable to a race condition in the MCL Smart Patient Reader software update system which allows unsigned firmware to be uploaded and executed on the Patient Reader. If exploited an attacker could remotely execute code on the MCL Smart Patient Reader device leading to control of the device.


Slurm before 19.05.8 and 20.x before 20.02.6 exposes Sensitive Information to an Unauthorized Actor because xauth for X11 magic cookies is affected by a race condition in a read operation on the /proc filesystem.


Under certain conditions when handling a ReadableStream a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0 Firefox < 74.0.1 and Firefox ESR < 68.6.1.


Under certain conditions when running the nsDocShell destructor a race condition can cause a use-after-free. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Thunderbird < 68.7.0 Firefox < 74.0.1 and Firefox ESR < 68.6.1.


There

exists

a

race

condition

between

the

deletion

of

the

temporary

file

and

the

creation

of

the

temporary

directory

in

`webkit`

subproject

of

HTML/Java

API

version

A

similar

vulnerability

has

recently

been

disclosed

in

other

Java

projects

and

the

fix

in

HTML/Java

API

version

follows

theirs:

To

avoid

local

privilege

escalation

version

creates

the

temporary

directory

atomically

without

dealing

with

the

temporary

file:


An Ubuntu-specific patch in PulseAudio created a race condition where the snap policy module would fail to identify a client connection from a snap as coming from a snap if SCM_CREDENTIALS were missing allowing the snap to connect to PulseAudio without proper confinement. This could be exploited by an attacker to expose sensitive information. Fixed in 1:13.99.3-1ubuntu2 1:13.99.2-1ubuntu2.1 1:13.99.1-1ubuntu3.8 1:11.1-1ubuntu7.11 and 1:8.0-0ubuntu3.15.


Razer Chroma SDK Rest Server through 3.12.17 allows remote attackers to execute arbitrary programs because there is a race condition in which a file created under \%PROGRAMDATA%\\Razer Chroma\\SDK\\Apps\ can be replaced before it is executed by the server. The attacker must have access to port 54236 for a registration step.


In FreeBSD 12.1-STABLE before r359565 12.1-RELEASE before p7 11.4-STABLE before r362975 11.4-RELEASE before p1 and 11.3-RELEASE before p11 missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious application to modify memory after being freed possibly resulting in code execution.


A RACE CONDITION on XQBACKUP causes a decompression path error on Xiaomi router AX3600 with ROM version =1.0.50.


On BIG-IP 15.0.0-15.0.1.3 14.1.0-14.1.2.3 13.1.0-13.1.3.3 12.1.0-12.1.5.1 and 11.6.1-11.6.5.1 a race condition exists where mcpd and other processes may make unencrypted connection attempts to a new configuration sync peer. The race condition can occur when changing the ConfigSync IP address of a peer adding a new peer or when the Traffic Management Microkernel (TMM) first starts up.


GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.


Time-of-check time-of-use race condition While processing partition entries due to newly created buffer was read again from mmc without validation in Snapdragon Auto Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


u'Two

threads

running

simultaneously

from

user

space

can

lead

to

race

condition

in

fastRPC

driver'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Connectivity

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in

Agatti

Bitra

Kamorta

Nicobar

Rennell

Saipan


Use after free due to race condition when reopening the device driver repeatedly in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Race condition in HAL layer while processing callback objects received from HIDL due to lack of synchronization between accessing objects in Snapdragon Auto Snapdragon Compute Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Possible out of bounds while accessing global control elements due to race condition in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables Snapdragon Wired Infrastructure and Networking


Possible race condition during async fastrpc session after sending RPC message due to the fastrpc ctx gets free during async session in Snapdragon Compute Snapdragon Industrial IOT Snapdragon Mobile


Arbitrary read and write to kernel addresses by temporarily overwriting ring buffer pointer and creating a race condition. in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Voice & Music Snapdragon Wearables


Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Industrial IOT Snapdragon Mobile Snapdragon Wearables


In the Linux kernel 4.19 through 5.6.7 on the s390 platform code execution may occur because of a race condition as demonstrated by code in enable_sacf_uaccess in arch/s390/lib/uaccess.c that fails to protect against a concurrent page table upgrade aka CID-3f777e19d171. A crash could also occur.


In multiple functions in DrmPlugin.cpp there is a possible use after free due to a race condition. This could lead to local code execution with System execution privileges required. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-137878930


An issue was discovered in mm/mmap.c in the Linux kernel before 5.7.11. There is a race condition between certain expand functions (expand_downwards and expand_upwards) and page-table free operations from an munmap call aka CID-246c320a8cfe.


A concurrent execution using shared resource with improper synchronization ('race condition') in the command shell of FortiSandbox before 3.2.2 may allow an authenticated attacker to bring the system into an unresponsive state via specifically orchestrated sequences of commands.


An issue was discovered in __split_huge_pmd in mm/huge_memory.c in the Linux kernel before 5.7.5. The copy-on-write implementation can grant unintended write access because of a race condition in a THP mapcount check aka CID-c444eb564fb1.


An issue was discovered in do_madvise in mm/madvise.c in the Linux kernel before 5.6.8. There is a race condition between coredump operations and the IORING_OP_MADVISE implementation aka CID-bc0c4d1e176e.


An issue was discovered in SDDM before 0.19.0. It incorrectly starts the X server in a way that - for a short time period - allows local unprivileged users to create a connection to the X server without providing proper authentication. A local attacker can thus access X server display contents and for example intercept keystrokes or access the clipboard. This is caused by a race condition during Xauthority file creation.


A race condition flaw was found in Ansible Engine 2.7.17 and prior 2.8.9 and prior 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user the temporary directory is created in /var/tmp. This directory is created with \umask 77 && mkdir -p <dir>\; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.


A race condition vulnerability on Juniper Network Junos OS devices may cause the routing protocol daemon (RPD) process to crash and restart while processing a BGP NOTIFICATION message. This issue affects Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S6; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11 17.1R3-S1; 17.2 versions prior to 17.2R1-S9 17.2R3-S3; 17.2 version 17.2R2 and later versions; 17.2X75 versions prior to 17.2X75-D105 17.2X75-D110; 17.3 versions prior to 17.3R2-S5 17.3R3-S6; 17.4 versions prior to 17.4R2-S7 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3-S3; 18.2X75 versions prior to 18.2X75-D410 18.2X75-D420 18.2X75-D50 18.2X75-D60; 18.3 versions prior to 18.3R1-S5 18.3R2-S2 18.3R3; 18.4 versions prior to 18.4R2-S2 18.4R3; 19.1 versions prior to 19.1R1-S2 19.1R2; 19.2 versions prior to 19.2R1-S4 19.2R2. This issue does not affect Juniper Networks Junos OS prior to version 16.1R1.


When DNS filtering is enabled on Juniper Networks Junos MX Series with one of the following cards MS-PIC MS-MIC or MS-MPC an incoming stream of packets processed by the Multiservices PIC Management Daemon (mspmand) process might be bypassed due to a race condition. Due to this vulnerability mspmand process responsible for managing \URL Filtering service\ can crash causing the Services PIC to restart. While the Services PIC is restarting all PIC services including DNS filtering service (DNS sink holing) will be bypassed until the Services PIC completes its boot process. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S8; 18.3 versions prior to 18.3R3-S1; 18.4 versions prior to 18.4R3; 19.1 versions prior to 19.1R3; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R3. This issue does not affect Juniper Networks Junos OS 17.4 18.1 and 18.2.


HUAWEI Mate 30 with versions earlier than 10.1.0.150(C00E136R5P3) have a race condition vulnerability. There is a timing window exists in which certain pointer members can be modified by another process that is operating concurrently an attacker should trick the user into running a crafted application with high privilege successful exploit could cause code execution.


Huawei NIP6800 versions V500R001C30 V500R001C60SPC500 and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200 V500R001C30SPC600 V500R001C60SPC500 and V500R005C00 have a Dangling pointer dereference vulnerability. An authenticated attacker may do some special operations in the affected products in some special scenarios to exploit the vulnerability. Due to improper race conditions of different operations successful exploit will lead to Dangling pointer dereference causing some service abnormal.


An issue was discovered in Janus through 0.9.1. plugins/janus_voicemail.c in the VoiceMail plugin has a race condition that could cause a server crash.


In OSIsoft PI System multiple products and versions an authenticated remote attacker could crash PI Network Manager due to a race condition. This can result in blocking connections and queries to PI Data Archive.


An issue was discovered on Samsung mobile devices with O(8.x) P(9.0) and Q(10.0) (S.LSI chipsets) software. There are race conditions in the hdcp2 driver. The Samsung ID is SVE-2019-16296 (February 2020).


There is a use-after-free in kernel versions before 5.5 due to a race condition between the release of ptp_clock and cdev while resource deallocation. When a (high privileged) process allocates a ptp device file (like /dev/ptpX) and voluntarily goes to sleep. During this time if the underlying device is removed it can cause an exploitable condition as the process wakes up to terminate and clean all attached files. The system crashes due to the cdev structure being invalid (as already freed) which is pointed to by the inode.


An issue was discovered in Janus through 0.9.1. janus.c has multiple concurrent threads that misuse the source property of a session leading to a race condition when claiming sessions.


An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18 2.8.12 and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5 3.5.6 and 3.6.4 as well as previous versions are affected.


init_tmp in TeeJee.FileSystem.vala in Timeshift before 20.03 unsafely reuses a preexisting temporary directory in the predictable location /tmp/timeshift. It follows symlinks in this location or uses directories owned by unprivileged users. Because Timeshift also executes scripts under this location an attacker can attempt to win a race condition to replace scripts created by Timeshift with attacker-controlled scripts. Upon success an attacker-controlled script is executed with full root privileges. This logic is practically always triggered when Timeshift runs regardless of the command-line arguments used.


An issue was discovered in Janus through 0.9.1. plugins/janus_videocall.c in the VideoCall plugin mishandles session management because a race condition causes some references to be freed too early or too many times.


A race condition was found in the mkhomedir tool shipped with the oddjob package in versions before 0.34.5 and 0.34.6 wherein during the home creation mkhomedir copies the /etc/skel directory into the newly created home and changes its ownership to the home's user without properly checking the homedir path. This flaw allows an attacker to leverage this issue by creating a symlink point to a target folder which then has its ownership transferred to the new home directory's unprivileged user.


An issue was discovered on Samsung mobile devices with O(8.x) P(9.0) and Q(10.0) software. There is a race condition leading to a use-after-free in MTP. The Samsung ID is SVE-2019-16520 (February 2020).


A

race

condition

can

occur

when

using

the

fastrpc

memory

mapping

API.

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Wearables

in


The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is installed. This vulnerability is not present in VMware Tools 11.x.y since the affected functionality is not present in VMware Tools 11.


A vulnerability in the endpoint software of Cisco AMP for Endpoints and Clam AntiVirus could allow an authenticated local attacker to cause the running software to delete arbitrary files on the system. The vulnerability is due to a race condition that could occur when scanning malicious files. An attacker with local shell access could exploit this vulnerability by executing a script that could trigger the race condition. A successful exploit could allow the attacker to delete arbitrary files on the system that the attacker would not normally have privileges to delete producing system instability or causing the endpoint software to stop working.


VMware ESXi (7.0 before ESXi_7.0.0-1.20.16321839 6.7 before ESXi670-202004101-SG and 6.5 before ESXi650-202005401-SG) Workstation (15.x before 15.5.2) and Fusion (11.x before 11.5.2) contain a heap-overflow due to a race condition issue in the USB 2.0 controller (EHCI). A malicious actor with local access to a virtual machine may be able to exploit this vulnerability to execute code on the hypervisor from a virtual machine. Additional conditions beyond the attacker's control must be present for exploitation to be possible.


The __mptctl_ioctl function in drivers/message/fusion/mptctl.c in the Linux kernel before 5.4.14 allows local users to hold an incorrect lock during the ioctl operation and trigger a race condition i.e. a \double fetch\ vulnerability aka CID-28d76df18f0a. NOTE: the vendor states \The security impact of this bug is not as bad as it could have been because these operations are all privileged and root already has enormous destructive power.\


When browsing a malicious page a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash. This vulnerability affects Thunderbird < 68.9.0 Firefox < 77 and Firefox ESR < 68.9.


Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3 in the rare case where Message Aggregation is enabled allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user.


Race condition in ASP firmware could allow less privileged x86 code to perform ASP SMM (System Management Mode) operations.


SQLiteODBC 0.9996 as packaged for certain Linux distributions as 0.9996-4 has a race condition leading to root privilege escalation because any user can replace a /tmp/sqliteodbc$$ file with new contents that cause loading of an arbitrary library.


A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. This vulnerability affects Firefox ESR < 68.8 Firefox < 76 and Thunderbird < 68.8.0.


CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race an unprivileged attacker can set up a log and report file and control that up to the point where the specific routine is doing its check. After that the file can be removed recreated and used for additional attacks.


A race condition due to insecure creation of a file in a temporary directory vulnerability in PAN-OS allows for root privilege escalation from a limited linux user account. This allows an attacker who has escaped the restricted shell as a low privilege administrator possibly by exploiting another vulnerability to escalate privileges to become root user. This issue affects: PAN-OS 7.1 versions earlier than 7.1.26; PAN-OS 8.1 versions earlier than 8.1.13; PAN-OS 9.0 versions earlier than 9.0.6; All versions of PAN-OS 8.0.


A race condition vulnerability Palo Alto Networks GlobalProtect app on Windows allows a local limited Windows user to execute programs with SYSTEM privileges. This issue can be exploited only while performing a GlobalProtect app upgrade. This issue affects: GlobalProtect app 5.0 versions earlier than GlobalProtect app 5.0.10 on Windows; GlobalProtect app 5.1 versions earlier than GlobalProtect app 5.1.4 on Windows.


An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5) 4.4.x versions (prior to 4.4.15.9) and 4.0.x versions (prior to 4.0.10.18) are affected.


Race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings aka a \double fetch\ vulnerability.


In F5 BIG-IP 12.1.0 through 12.1.2 permissions enforced by iControl can lag behind the actual permissions assigned to a user if the role_map is not reloaded between the time the permissions are changed and the time of the user's next request. This is a race condition that occurs rarely in normal usage; the typical period in which this is possible is limited to at most a few seconds after the permission change.


Race condition in the environ_read function in fs/proc/base.c in the Linux kernel before 4.5.4 allows local users to obtain sensitive information from kernel memory by reading a /proc/*/environ file during a process-setup time interval in which environment-variable copying is incomplete.


Race condition in wget 1.17 and earlier when used in recursive or mirroring mode to download a single file might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.


An issue was discovered in drivers/net/ethernet/arc/emac_main.c in the Linux kernel before 4.5. A use-after-free is caused by a race condition between the functions arc_emac_tx and arc_emac_tx_clean.


A time-of-check time-of-use race condition could potentially exist in the secure file system in all Android releases from CAF using the Linux kernel.


Race condition in Oracle MySQL before 5.5.52 5.6.x before 5.6.33 5.7.x before 5.7.15 and 8.x before 8.0.1; MariaDB before 5.5.52 10.0.x before 10.0.28 and 10.1.x before 10.1.18; Percona Server before 5.5.51-38.2 5.6.x before 5.6.32-78-1 and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0 5.6.x before 5.6.32-25.17 and 5.7.x before 5.7.14-26.17 allows local users with certain permissions to gain privileges by leveraging use of my_copystat by REPAIR TABLE to repair a MyISAM table.


Race condition in the audit_log_single_execve_arg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string aka a \double fetch\ vulnerability.


authd sets weak permissions for /etc/ident.key which allows local users to obtain the key by leveraging a race condition between the creation of the key and the chmod to protect it.


Race condition in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to obtain sensitive information via unspecified vectors.


in

openldap-servers

sets

weak

permissions

for

the

TLS

certificate

which

allows

local

users

to

obtain

the

TLS

certificate

by

leveraging

a

race

condition

between

the

creation

of

the

certificate

and

the

chmod

to

protect

it.


Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping as exploited in the wild in October 2016 aka \Dirty COW.\


Race

condition

in

the

ResourceDispatcherHostImpl::BeginRequest

function

in

in

Google

Chrome

before

allows

remote

attackers

to

make

arbitrary

HTTP

requests

by

leveraging

access

to

a

renderer

process

and

reusing

a

request

ID.


Race

condition

in

the

Op

command

in

Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

before

before

before

or

before

or

and

before

allows

remote

authenticated

users

to

gain

privileges

via

the

URL

option.


Race

condition

in

the

RPC

functionality

in

Juniper

Junos

OS

before

before

before

before

before

before

before

before

before

before

before

before

or

before

and

before

allows

local

users

to

read

delete

or

modify

arbitrary

files

via

unspecified

vectors.


Race condition in Network Manager before 1.0.12 as packaged in Red Hat Enterprise Linux Desktop 7 Red Hat Enterprise Linux HPC Node 7 Red Hat Enterprise Linux Server 7 and Red Hat Enterprise Linux Workstation 7 allows local users to obtain sensitive connection information by reading temporary files during ifcfg and keyfile changes.


Race condition in Download Manager in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 and 6.x before 2016-04-01 allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target as demonstrated by obtaining Signature or SignatureOrSystem access aka internal bug 26211054.


Race condition in arch/x86/mm/tlb.c in the Linux kernel before 4.4.1 allows local users to gain privileges by triggering access to a paging structure by a different CPU.


Race condition in the kernel in Microsoft Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows local users to bypass the Low Integrity protection mechanism and write to files by leveraging unspecified object-manager features aka \Windows File System Security Feature Bypass.\


Race condition in providers/telephony/MmsProvider.java in Telephony in Android 4.x before 4.4.4 5.0.x before 5.0.2 5.1.x before 5.1.1 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application that modifies a database between two open operations aka internal bug 30481342.


Race condition in gzip 1.2.4 1.3.3 and earlier when decompressing a gzipped file allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed whose permissions are changed by gzip after the decompression is complete.


Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9 when using the Netscape Set-Cookie recommendations for handling cookies in caches may cause Set-Cookie headers to be sent to other users which allows attackers to steal the related cookies.


Race condition in bzip2 1.0.2 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed whose permissions are changed by bzip2 after the decompression is complete.


Race condition in sudo 1.3.1 up to 1.6.8p8 when the ALL pseudo-command is used after a user entry in the sudoers file allows local users to gain privileges via a symlink attack.


Race condition in shtool 2.0.1 and earlier allows local users to modify or create arbitrary files via a symlink attack on temporary files after they have been created a different vulnerability than CVE-2005-1751.


Sophos Anti-Virus 3.93 does not check downloaded files for viruses when they have only been written which creates a race condition and may allow remote attackers to bypass virus protection if the file is executed before the antivirus starts on system reboot.


Race condition in shtool 2.0.1 and earlier allows local users to create or modify arbitrary files via a symlink attack on the .shtool.$$ temporary file a different vulnerability than CVE-2005-1759.


Race condition in rpdump in Pine 4.62 and earlier allows local users to overwrite arbitrary files via a symlink attack.


Race condition in Core Utilities (coreutils) 5.2.1 when (1) mkdir (2) mknod or (3) mkfifo is running with the -m switch allows local users to modify permissions of other files.


Race condition in JFS2 on AIX 5.2 and 5.3 when deleting a file while I/O is still occurring for that file may write data to a different file which could leak sensitive information.


Race condition in libsafe 2.0.16 and earlier when running in multi-threaded applications allows attackers to bypass libsafe protection and exploit other vulnerabilities before the _libsafe_die function call is completed.


Race condition in Ce/Ceterm (aka ARPUS/Ce) 2.5.4 and earlier allows local users to write to arbitrary files via a symlink attack on the ce_edit_log temporary file.


Race condition in cpio 2.6 and earlier allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed whose permissions are changed by cpio after the decompression is complete.


Race condition in Microsoft Internet Explorer allows user-assisted attackers to overwrite arbitrary files and possibly execute code by tricking a user into performing a drag-and-drop action from certain objects such as file objects within a folder view then predicting the drag action and re-focusing to a malicious window.


Race condition in sandbox before 1.2.11 allows local users to create or overwrite arbitrary files via symlink attack on sandboxpids.tmp.


Race condition in Unzip 5.52 allows local users to modify permissions of arbitrary files via a hard link attack on a file while it is being decompressed whose permissions are changed by Unzip after the decompression is complete.


Race condition in Macromedia JRun 4.0 ColdFusion MX 6.1 and 7.0 when under heavy load causes JRun to assign a duplicate authentication token to multiple sessions which could allow authenticated users to gain privileges as other users.


Bugzilla 2.17.x 2.18 before 2.18.2 2.19.x and 2.20 before 2.20rc1 inserts a bug into the database before it is marked private which introduces a race condition and allows attackers to access information about the bug via buglist.cgi before MySQL replication is complete.


Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory possibly due to a symlink attack.


Race condition in IPCop (aka IPCop Firewall) before 1.4.10 might allow local users to overwrite system configuration files and gain privileges by replacing a backup archive during the time window when the archive is owned by \nobody\ but not yet encrypted then executing ipcoprscfg to restore from this backup.


Race condition in exec in OpenBSD 4.0 and earlier NetBSD 1.5.2 and earlier and FreeBSD 4.4 and earlier allows local users to gain privileges by attaching a debugger to a process before the kernel has determined that the process is setuid or setgid.


setpwnam.c in the util-linux package as included in Red Hat Linux 7.3 and earlier and other operating systems does not properly lock a temporary file when modifying /etc/passwd which may allow local users to gain privileges via a complex race condition that uses an open file descriptor in utility programs such as chfn and chsh.


Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier OpenLinux 3.1 and 3.1.1 and possibly other operating systems decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive which could allow local users to read the files as they are being decompressed.


Race condition in the recursive (1) directory deletion and (2) directory move in GNU File Utilities (fileutils) 4.1 and earlier allows local users to delete directories as the user running fileutils by moving a low-level directory to a higher level as it is being deleted which causes fileutils to chdir to a \..\ directory that is higher than expected possibly up to the root file system.


Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 allows local users with lp privileges to create or overwrite arbitrary files via file race conditions as demonstrated by ice-cream.


slapd in OpenLDAP2 (OpenLDAP 2) 2.2.0 and earlier allows local users to overwrite arbitrary files via a race condition during the creation of a log file for rejected replication requests.


The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.


Race condition in the rmtree function in File::Path 1.08 and 2.07 (lib/File/Path.pm) in Perl 5.8.8 and 5.10.0 allows local users to create arbitrary setuid binaries via a symlink attack a different vulnerability than CVE-2005-0448 CVE-2004-0452 and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5303 due to affected versions.


Race condition in the rmtree function in File::Path 1.08 (lib/File/Path.pm) in Perl 5.8.8 allows local users to to delete arbitrary files via a symlink attack a different vulnerability than CVE-2005-0448 CVE-2004-0452 and CVE-2008-2827. NOTE: this is a regression error related to CVE-2005-0448. It is different from CVE-2008-5302 due to affected versions.


rc.sysinit in initscripts 8.12-8.21 and 8.56.15-0.1 on rPath allows local users to delete arbitrary files via a symlink attack on a directory under (1) /var/lock or (2) /var/run. NOTE: this issue exists because of a race condition in an incorrect fix for CVE-2008-3524. NOTE: exploitation may require an unusual scenario in which rc.sysinit is executed other than at boot time.


Race condition in Login Window in Apple Mac OS X 10.5 through 10.5.4 when a blank-password account is enabled allows attackers to bypass password authentication and login to any account via multiple attempts to login to the blank-password account followed by selection of an arbitrary account from the user list.


Race condition in (1) checkinstall 1.6.1 and (2) installwatch allows local users to overwrite arbitrary files and have other impacts via symlink and possibly other attacks on temporary working directories.


Race condition in the create_lockpath function in policyd-weight 0.1.14 beta-16 allows local users to modify or delete arbitrary files by creating the LOCKPATH directory then modifying it after the symbolic link check occurs. NOTE: this is due to an incomplete fix for CVE-2008-1569.


suPHP before 0.6.3 allows local users to gain privileges via (1) a race condition that involves multiple symlink changes to point a file owned by a different user or (2) a symlink to the directory of a different user which is used to determine privileges.


Linux kernel before 2.6.25.2 does not apply a certain protection mechanism for fcntl functionality which allows local users to (1) execute code in parallel or (2) exploit a race condition to obtain \re-ordered access to the descriptor table.\


The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it which allows local users to gain privileges via a race condition between the signature validation and the module initialization.


FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular it uses the MD5File() function which takes a pathname as an argument and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.


Race condition in mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4 VMware Player 3.1.x before 3.1.4 VMware Fusion 3.1.x before 3.1.3 VMware ESXi 3.5 through 4.1 and VMware ESX 3.0.3 through 4.1 allows guest OS users to gain privileges on the guest OS by mounting a filesystem on top of an arbitrary directory.


Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written which introduces a race condition that allows local users to obtain a username and password by reading this file.


Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.


A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.


A race condition in fastrpc kernel driver for dynamic process creation can lead to use after free scenario in Snapdragon Auto Snapdragon Connectivity Snapdragon Mobile Snapdragon Wearables


A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.


A race condition in MandrakeUpdate allows local users to modify RPM files while they are in the /tmp directory before they are installed.


A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.


A race condition in the Solaris ps command allows an attacker to overwrite critical files.


A race condition in the BackWeb Polite Agent Protocol allows an attacker to spoof a BackWeb server.


A race condition in the authentication agent mechanism of sshd 1.2.17 allows an attacker to steal another user's credentials.


A race condition in crrtrap for QNX RTP 6.1 allows local users to gain privileges by modifying the PATH environment variable to reference a malicious io-graphics program before is executed by crrtrap.


A race condition in nessus-adduser in Nessus 2.0.11 and possibly earlier versions if the TMPDIR environment variable is not set allows local users to gain privileges.


A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root.


A race condition in navigation in Google Chrome prior to 58.0.3029.81 for Linux Windows and Mac allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.


A race condition in drm_atomic_nonblocking_commit() in the display driver can potentially lead to a Use After Free scenario in all Android releases from CAF (Android for MSM Firefox OS for MSM QRD Android) using the Linux Kernel.


A race condition in chown_one() of systemd allows an attacker to cause systemd to set arbitrary permissions on arbitrary files. Affected releases are systemd versions up to and including 239.


A race condition in Oilpan in Google Chrome prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


I race condition in Temp files was found in gs-gpl before 8.56 addons scripts.


Multiple race conditions in the Phone app in Apple iOS before 7.0.3 allow physically proximate attackers to bypass the locked state and dial the telephone numbers in arbitrary Contacts entries by visiting the Contacts pane.


Multiple race conditions in certain system call wrappers in Generic Software Wrappers Toolkit (GSWTK) allow local users to defeat system call interposition and possibly gain privileges or bypass auditing.


Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.


Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition and consequently bypass access control policy and auditing.


Multiple race conditions in the sandbox infrastructure in Google Chrome before 4.1.249.1036 have unspecified impact and attack vectors.


Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to \bri restart logic.\


Multiple race conditions in Comodo Internet Security before 5.8.211697.2124 allow local users to bypass the Defense+ feature via unspecified vectors.


Multiple race conditions in Comodo Internet Security before 5.8.213334.2131 allow local users to bypass the Defense+ feature via unspecified vectors.


In the Linux kernel before 5.2.10 there is a race condition bug that can be caused by a malicious USB device in the USB character device driver layer aka CID-303911cfc5b9. This affects drivers/usb/core/file.c.


In the Linux kernel before 4.20.8 kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition leading to a use-after-free.


In the Linux kernel before 5.4.16 a race condition in tty->disc_data handling in the slip and slcan line discipline could lead to a use-after-free aka CID-0ace17d56824. This affects drivers/net/slip/slip.c and drivers/net/can/slcan.c.


In the standard library in Rust before 1.19.0 there is a synchronization problem in the MutexGuard object. MutexGuards can be used across threads with any types allowing for memory safety issues through race conditions.


In the standard library in Rust before 1.29.0 there is weak synchronization in the Arc::get_mut method. This synchronization issue can be lead to memory safety issues through race conditions.


In TrustZone in all Android releases from CAF using the Linux kernel a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist.


A race condition was addressed with additional validation. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4. A malicious application may be able to gain root privileges.


A race condition was addressed with improved locking. This issue is fixed in macOS Monterey 12.1 Security Update 2021-008 Catalina macOS Big Sur 11.6.2. A remote attacker may be able to cause unexpected application termination or heap corruption.


A race condition was addressed with improved state handling. This issue is fixed in iOS 14.7 macOS Big Sur 11.5. Opening a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution.


A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13.


A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes. A local authenticated attacker could use this flaw to kill other processes with root privileges under specific conditions.


A race condition was addressed with additional validation. This issue affected versions prior to iOS 11.2 macOS High Sierra 10.13.2 tvOS 11.2 watchOS 4.2 iTunes 12.7.2 for Windows macOS High Sierra 10.13.4.


A race condition was discovered in the Linux drivers for Nvidia graphics which allowed an attacker to exfiltrate kernel memory to userspace. This issue was fixed in version 295.53.


A race condition was addressed with additional validation. This issue affected versions prior toiVersions prior to: OS 11.4.1 tvOS 11.4.1 watchOS 4.3.2 Safari 11.1.2 iTunes 12.8 for Windows iCloud for Windows 7.6.


A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-005 Catalina. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.


A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.0.1 Security Update 2021-007 Catalina macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with improved locking. This issue is fixed in macOS Monterey 12.0.1 macOS Big Sur 11.6.1. A malicious application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with improved locking. This issue is fixed in macOS Monterey 12.0.1. A malicious application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with additional validation. This issue is fixed in macOS Catalina 10.15.6. A malicious application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with improved state handling. This issue is fixed in macOS Catalina 10.15.5. An application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.1 iOS 15.2 and iPadOS 15.2. A malicious application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with improved state handling. This issue is fixed in macOS Monterey 12.1 watchOS 8.3 iOS 15.2 and iPadOS 15.2 tvOS 15.2. A malicious application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with improved locking. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1. An application may be able to execute arbitrary code with kernel privileges.


A race condition was addressed with improved state handling. This issue is fixed in iOS 14.6 and iPadOS 14.6. An application may be able to cause unexpected system termination or write kernel memory.


A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.2 macOS Monterey 12.1 Safari 15.2 iOS 15.2 and iPadOS 15.2 watchOS 8.3. Processing maliciously crafted web content may lead to arbitrary code execution.


A race condition was addressed with improved state handling. This issue is fixed in iOS 13.5 and iPadOS 13.5 macOS Catalina 10.15.5 tvOS 13.4.5 watchOS 6.2.5. An application may be able to gain elevated privileges.


A race condition in Intel(R) Graphics Drivers before version 10.18.14.5067 (aka 15.36.x.5067) and 10.18.10.5069 (aka 15.33.x.5069) may allow an authenticated user to potentially enable a denial of service via local access.


In

ActivityManagerService.attachApplication

of

ActivityManagerService

there

is

a

possible

race

condition.

This

could

lead

to

local

escalation

of

privilege

with

no

additional

execution

privileges

needed.

User

interaction

is

not

needed

for

exploitation.

Product:

Android.

Versions:

Android

ID:


Race condition in Google Chrome before 22.0.1229.92 allows remote attackers to execute arbitrary code via vectors related to audio devices.


Race condition in Google Chrome before 17.0.963.46 allows remote attackers to execute arbitrary code via vectors that trigger a crash of a utility process.


Race condition in Google Chrome before 9.0.597.84 allows remote attackers to execute arbitrary code via vectors related to audio.


Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows local users to execute arbitrary code by manipulating the VMA descriptor.


Race condition in the kernel in Apple iOS before 9.3 and OS X before 10.11.4 allows attackers to execute arbitrary code in a privileged context via a crafted app.


Race condition in the Radeon DRI driver for Linux kernel 2.6.8.1 allows local users with DRI privileges to execute arbitrary code as root.


Race condition in the NSURLConnection cache management functionality in Foundation for Apple Mac OS X 10.4.11 allows remote attackers to execute arbitrary code via unspecified manipulations that cause messages to be sent to a deallocated object.


In Magento prior to 1.9.4.3 Magento prior to 1.14.4.3 Magento 2.2 prior to 2.2.10 and Magento 2.3 prior to 2.3.3 or 2.3.2-p1 an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.


Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature as demonstrated by installing a file in the /etc/cron.d directory.


A time-of-check to time-of-use (TOCTOU) race condition vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permission to upload plugins to execute arbitrary code with root user privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11; PAN-OS 10.0 versions earlier than PAN-OS 10.0.7; PAN-OS 10.1 versions earlier than PAN-OS 10.1.2. This issue does not affect Prisma Access.


A race condition was addressed with additional validation. This issue is fixed in macOS Big Sur 11.2.1 macOS Catalina 10.15.7 Supplemental Update macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges.


A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for DLL files that are loaded on an affected device. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with SYSTEM privileges. To exploit this vulnerability the attacker must have valid credentials on the Windows system.


A race condition existed in the snapd 2.54.2 snap-confine binary when preparing a private mount namespace for a snap. This could allow a local attacker to gain root privileges by bind-mounting their own contents inside the snap's private mount namespace and causing snap-confine to execute arbitrary code and hence gain privilege escalation. Fixed in snapd versions 2.54.3+18.04 2.54.3+20.04 and 2.54.3+21.10.1


A vulnerability in the shared library loading mechanism of Cisco AnyConnect Secure Mobility Client for Linux and Mac OS could allow an authenticated local attacker to perform a shared library hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to a race condition in the signature verification process for shared library files that are loaded on an affected device. An attacker could exploit this vulnerability by sending a series of crafted interprocess communication (IPC) messages to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected device with root privileges. To exploit this vulnerability the attacker must have a valid account on the system.


Race Condition within a Thread vulnerability in iscsi_snapshot_comm_core in Synology DiskStation Manager (DSM) before 6.2.3-25426-3 allows remote attackers to execute arbitrary code via crafted web requests.


Race condition in ESET NOD32 Antivirus before 2.2289 allows remote attackers to execute arbitrary code via a crafted CAB file which triggers heap corruption.


Multiple race conditions in suexec in Apache HTTP Server (httpd) 2.2.3 between directory and file validation and their usage allow local users to gain privileges and execute arbitrary code by renaming directories or performing symlink attacks. NOTE: the researcher who is reliable claims that the vendor disputes the issue because \the attacks described rely on an insecure server configuration\ in which the user \has write access to the document root.\


The Net Direct client for Linux before 6.0.5 in Nortel Application Switch 2424 VPN 3050 and 3070 and SSL VPN Module 1000 extracts and executes files with insecure permissions which allows local users to exploit a race condition to replace a world-writable file in /tmp/NetClient and cause another user to execute arbitrary code when attempting to execute this client as demonstrated by replacing /tmp/NetClient/client.


Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running \pm install\ with the target apk and simultaneously running a crafted script to process logcat's output looking for a dexopt line which once found should execute bindBackupAgent with the uid member of the ApplicationInfo parameter set to 1000.


Race

condition

in

the

function

in

in

xul.dll

in

Mozilla

Firefox

before

might

allow

remote

attackers

to

execute

arbitrary

code

via

a

page

transition

during

Java

applet

loading

related

to

a

use-after-free

vulnerability

for

memory

associated

with

a

destroyed

Java

object.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves the \Kernel\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.12.5 is affected. The issue involves the \DiskArbitration\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.12.4 is affected. The issue involves the \AppleGraphicsPowerManagement\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \Kernel\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. watchOS before 3.2.2 is affected. The issue involves the \IOSurface\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to execute arbitrary code on the host OS because of a race condition that can cause a stale TLB entry.


Inappropriate symlink handling and a race condition in the stateful recovery feature implementation could lead to a persistance established by a malicious code running with root privileges in cryptohomed in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.


MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges.


Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947.


Race condition in runner in Install.framework in the Install Framework Legacy component in Apple OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages incorrect privilege dropping associated with a locking error.


Race condition in the JavaScript garbage collection in Mozilla Firefox 1.5 before 1.5.0.5 Thunderbird before 1.5.0.5 and SeaMonkey before 1.0.3 might allow remote attackers to execute arbitrary code by causing the garbage collector to delete a temporary variable while it is still being used during the creation of a new Function object.


Signal handler race condition in Sendmail 8.13.x before 8.13.6 allows remote attackers to execute arbitrary code by triggering timeouts in a way that causes the setjmp and longjmp function calls to be interrupted and modify unexpected memory locations.


Race condition in phfont in QNX Neutrino RTOS 6.2.1 allows local users to execute arbitrary code via unspecified manipulations of the PHFONT and PHOTON2_PATH environment variables.


Race condition in Deja Vu as used in Roxio Toast Titanium 7 and possibly other products allows local users to execute arbitrary code via temporary files including dejavu_manual.rb which are executed with raised privileges.


The \make distcheck\ rule in GNU Automake before 1.11.6 and 1.12.x before 1.12.2 grants world-writable permissions to the extraction directory which introduces a race condition that allows local users to execute arbitrary code via unspecified vectors.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the \Storage\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. watchOS before 4.3 is affected. The issue involves the \CoreFoundation\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the \NVIDIA Graphics Drivers\ component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that triggers a SetAppSupportBits use-after-free because of a race condition.


An issue was discovered in certain Apple products. macOS before 10.13.5 is affected. The issue involves the \IOFireWireAVC\ component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages a race condition.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the \iCloud Drive\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the \CoreFoundation\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the \NSURLSession\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the \Quick Look\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the \Notes\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a race condition.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the \File System Events\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. The issue involves the \PluginKit\ component. A race condition allows attackers to execute arbitrary code in a privileged context via a crafted app.


A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.


TOCTOU Race Condition vulnerability in apport allows a local attacker to escalate privileges and execute arbitrary code. An attacker may exit the crashed process and exploit PID recycling to spawn a root process with the same PID as the crashed process which can then be used to escalate privileges. Fixed in 2.20.1-0ubuntu2.24 2.20.9 versions prior to 2.20.9-0ubuntu7.16 and 2.20.11 versions prior to 2.20.11-0ubuntu27.6. Was ZDI-CAN-11234.


IBM BigFix Platform could allow a remote attacker to execute arbitrary code on the system caused by a use-after-free race condition. An attacker could exploit this vulnerability to execute arbitrary code on the system.


modes.c in smail 3.2.0.120 implements signal handlers with certain unsafe library calls which may allow attackers to execute arbitrary code via signal handler race conditions possibly using xmalloc.


Race condition in the page fault handler (fault.c) for Linux kernel 2.2.x to 2.2.7 2.4 to 2.4.29 and 2.6 to 2.6.10 when running on multiprocessor machines allows local users to execute arbitrary code via concurrent threads that share the same virtual memory space and simultaneously request stack expansion.


Race condition in NSXML in Foundation for Apple Mac OS X 10.4.11 allows context-dependent attackers to execute arbitrary code via a crafted XML file related to \error handling logic.\


Launch Services in Apple Mac OS X before 10.5 when Open Safe Files is enabled allows remote attackers to execute arbitrary code via a symlink attack probably related to a race condition and automatic execution of a downloaded file.


A race condition was addressed with improved locking. This issue is fixed in Security Update 2021-005 Catalina iOS 14.8 and iPadOS 14.8 tvOS 15 iOS 15 and iPadOS 15 watchOS 8 macOS Big Sur 11.6. A malicious application may be able to execute arbitrary code with kernel privileges.


Race condition in the SMB client implementation in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to execute arbitrary code and in the SMB client implementation in Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows local users to gain privileges via a crafted SMB Negotiate response aka \SMB Client Race Condition Vulnerability.\

race condition
arbitrary code execution
man in the middle


Race condition in the installation script for Tarantella Enterprise 3 3.01 through 3.20 creates a world-writeable temporary \gunzip\ program before executing it which could allow local users to execute arbitrary commands by modifying the program before it is executed.

race condition
arbitrary command execution


In android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel missing race condition protection while updating msg mask table can lead to buffer over-read. Also access to freed memory can happen while updating msg_mask information.


Race condition in the do_add_counters function in netfilter for Linux kernel 2.6.16 allows local users with CAP_NET_ADMIN capabilities to read kernel memory by triggering the race condition in a way that produces a size value that is inconsistent with allocated memory which leads to a buffer over-read in IPT_ENTRY_ITERATE.


In all Android releases from CAF using the Linux kernel a race condition exists in a video driver potentially leading to buffer overflow or write to arbitrary pointer location.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel in a video driver a race condition exists which can potentially lead to a buffer overflow.


Wind River VxWorks 6.9.4 and vx7 has a Buffer Overflow in the TCP component (issue 4 of 4). There is an IPNET security vulnerability: TCP Urgent Pointer state confusion due to race condition.


In Android for MSM Firefox OS for MSM QRD Android with all Android releases from CAF using the Linux kernel due to a race condition in a firmware loading routine a buffer overflow could potentially occur if multiple user space threads try to update the WLAN firmware file through sysfs.


An issue was discovered on Samsung mobile devices with M(6.0) and N(7.0) (MSM8939 MSM8996 MSM8998 Exynos7580 Exynos8890 or Exynos8895 chipsets) software. There is a race condition with a resultant buffer overflow in the sec_ts touchscreen sysfs interface. The Samsung ID is SVE-2016-7501 (January 2017).


An issue was discovered on Samsung mobile devices with M(6 x) and N(7.0) software. The TA Scrypto v1.0 implementation in Secure Driver has a race condition with a resultant buffer overflow. The Samsung IDs are SVE-2017-8973 SVE-2017-8974 and SVE-2017-8975 (November 2017).


In all Qualcomm products with Android releases from CAF using the Linux kernel in function msm_compr_ioctl_shared variable \ddp->params_length\ could be accessed and modified by multiple threads while it is not protected with locks. If one thread is running while another thread is setting data race conditions will happen. If \ddp->params_length\ is set to a big number a buffer overflow will occur.


In core_info_read and inst_info_read in all Android releases from CAF using the Linux kernel variable \dbg_buf\ \dbg_buf->curr\ and \dbg_buf->filled_size\ could be modified by different threads at the same time but they are not protected with mutex or locks. Buffer overflow is possible on race conditions. \buffer->curr\ itself could also be overwritten which means that it may point to anywhere of kernel memory (for write).


In all Qualcomm products with Android releases from CAF using the Linux kernel during the wlan calibration data store and retrieve operation there are some potential race conditions which lead to a memory leak and a buffer overflow during the context switch.


In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019 MDM9206 MDM9607 MDM9625 MDM9635M MSM8909W SD 210/SD 212/SD 205 SD 400 SD 410/12 SD 600 SD 615/16/SD 415 SD 617 SD 650/52 SD 800 SD 808 and SD 810 in widevine_dash_cmd_handler() rsp buffers are passed off to widevine commands. These rsp buffers have values in them such as buffer lengths that need to be validated to ensure that no buffer overflow/over-reads happen. However rsp buffers are not always in locked memory meaning a time-of-check time-of-use issue can occur where we check that the value is valid but then a race condition occurs where this memory is swapped out with a different possibly out of range value.


An issue was discovered on Samsung mobile devices with KK(4.4) L(5.0/5.1) and M(6.0) (with Hrm sensor support) software. The sysfs of the MAX86902 sensor driver does not prevent concurrent access leading to a race condition and resultant heap-based buffer overflow. The Samsung ID is SVE-2016-7341 (December 2016).


Multiple race conditions in ssl/t1_lib.c in OpenSSL 0.9.8f through 0.9.8o 1.0.0 and 1.0.0a when multi-threading and internal caching are enabled on a TLS server might allow remote attackers to execute arbitrary code via client data that triggers a heap-based buffer overflow related to (1) the TLS server name extension and (2) elliptic curve cryptography.

race condition
buffer overflow
arbitrary code execution


Foxit Reader before 9.5 and PhantomPDF before 8.3.10 and 9.x before 9.5 has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read a different issue than CVE-2018-20310 because of a different opcode.

race condition
buffer overflow
out of bound read


Foxit Reader before 9.5 and PhantomPDF before 8.3.10 and 9.x before 9.5 has a proxyPreviewAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.


Foxit Reader before 9.5 and PhantomPDF before 8.3.10 and 9.x before 9.5 has a proxyCPDFAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.


Foxit Reader before 9.5 and PhantomPDF before 8.3.10 and 9.x before 9.5 has a proxyGetAppEdition race condition that can cause a stack-based buffer overflow or an out-of-bounds read.


Foxit Reader before 9.5 and PhantomPDF before 8.3.10 and 9.x before 9.5 has a race condition that can cause a stack-based buffer overflow or an out-of-bounds read.


Foxit Reader before 9.5 and PhantomPDF before 8.3.10 and 9.x before 9.5 has a proxyDoAction race condition that can cause a stack-based buffer overflow or an out-of-bounds read.


Foxit Reader before 9.5 and PhantomPDF before 8.3.10 and 9.x before 9.5 has a proxyCheckLicence race condition that can cause a stack-based buffer overflow or an out-of-bounds read.


Race condition in the Firewall Authentication Proxy feature in Cisco IOS 12.0 through 12.4 allows remote attackers to bypass authentication or bypass the consent web page via a crafted request aka Bug ID CSCsy15227.


Race condition in the mod_auth_shadow module for the Apache HTTP Server allows remote attackers to bypass authentication and read and possibly modify data via vectors related to improper interaction with an external helper application for validation of credentials.


Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049 CB before CB.02.049 PP before PP.02.049 and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.


A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.

race condition
cross site request forgery


runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.


Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files via a request to port 40080 or 40443.


Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access and consequently provide FileReader.jsp input containing directory traversal sequences to read arbitrary text files via a request to port 40080 or 40443.


Race condition in the Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0 allows local users to modify memory and gain privileges via the temporary \\Device\\PhysicalMemory section handle a related issue to CVE-2007-1206.


A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. A malicious application may be able to elevate privileges. Apple is aware of a report that this issue may have been actively exploited..


A race condition was addressed with additional validation. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. A malicious application may be able to gain root privileges.


A race condition was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. A malicious application may be able to elevate privileges.


The Virtual DOS Machine (VDM) in the Windows Kernel in Microsoft Windows NT 4.0; 2000 SP4; XP SP2; Server 2003 2003 SP1 and 2003 SP2; and Windows Vista before June 2006; uses insecure permissions (PAGE_READWRITE) for a physical memory view which allows local users to gain privileges by modifying the \zero page\ during a race condition before the view is unmapped.


A race condition was addressed with additional validation. This issue is fixed in iOS 13.4 and iPadOS 13.4 tvOS 13.4 Safari 13.1 iTunes for Windows 12.10.5 iCloud for Windows 10.9.3 iCloud for Windows 7.18. An application may be able to read restricted memory.


Race condition in the firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.


In the Android kernel in the mnh driver there is a race condition due to insufficient locking. This could lead to a use-after-free which could lead to escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.


In hostapd there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-129344244


In init of vendor_graphicbuffer_meta.cpp there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-188745089References: N/A


In synchronous_process_io_entries of lwis_ioctl.c there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-195731663References: N/A


In several functions of binder.c there is a possible way to represent the wrong domain to SELinux due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-200688826References: Upstream kernel


In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-197353344


In TBD of TBD there is a possible user after free vulnerability due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-176918884References: N/A


In FindOrCreatePeer of btif_av.cc there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-9 Android-10Android ID: A-169252501


In multiple methods of AAudioService there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-153358911


In

dispatchGraphTerminationMessage()

of

there

is

a

possible

use

after

free

due

to

a

race

condition.

This

could

lead

to

local

escalation

of

privilege

with

User

execution

privileges

needed.

User

interaction

is

not

needed

for

exploitation.

Product:

Android;

Versions:

Android

ID:


In decrypt of CryptoPlugin.cpp there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-176495665


In wrapUserThread of AudioStream.cpp there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-174801970


In unix_scm_to_skb of af_unix.c there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel


In ClearPullerCacheIfNecessary and ForceClearPullerCache of StatsPullerManager.cpp there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-173552790


In several functions of MemoryFileSystem.cpp and related files there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-10Android ID: A-176237595


In various functions of CryptoPlugin.cpp there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-176444161


In lockNow of PhoneWindowManager.java there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-161149543


In FindQuotaDeviceForUuid of QuotaUtils.cpp there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-169421939


In various functions of DrmPlugin.cpp there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-176444154


In aee driver there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209197; Issue ID: ALPS06209197.


In

startActivityForAttachedApplicationIfNeeded

of

RootWindowContainer.java

there

is

a

possible

way

to

overlay

an

app

that

believes

it's

still

in

the

foreground

when

it

is

not

due

to

a

race

condition.

This

could

lead

to

local

escalation

of

privilege

with

no

additional

execution

privileges

needed.

User

interaction

is

needed

for

exploitation.Product:

AndroidVersions:

ID:


In aee driver there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06209201; Issue ID: ALPS06226345.


In several functions of KeyguardServiceWrapper.java and related files there is a possible way to briefly view what's under the lockscreen due to a race condition. This could lead to local escalation of privilege if a Guest user is enabled with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-151095871


In ion_ioctl and related functions of ion.c there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-205707793References: N/A


In ion there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06399915; Issue ID: ALPS06399901.


In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046.


In run of InstallPackageTask.java in Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 and Android-9 it is possible that package verification is turned off and remains off due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-116754444.


In easelcomm_hw_build_scatterlist there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System privileges required. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-69808833.


In the ClearKey CAS descrambler there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-113027383


A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created but before it was chowned leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.


A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.


Race condition in a subsystem in the Intel(R) LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access.


Race condition in some Intel(R) Graphics Drivers before version 15.40.45.5126 may allow an authenticated user to potentially enable escalation of privilege via local access.


Race condition in subsystem for Intel(R) CSME versions before 12.0.70 and 14.0.45 Intel(R) SPS versions before E5_04.01.04.400 and E3_05.01.04.200 may allow an unauthenticated user to potentially enable escalation of privilege via physical access.


In the l2tp subsystem there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-152409173


In NFC there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-148294643


In HalCamera::requestNewFrame of HalCamera.cpp there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-169282240