596 vulnerabilities classified as CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)). AI Chinese analysis included.
CWE-362 represents a concurrency weakness where multiple threads access a shared resource without proper synchronization, creating a timing window for unauthorized modification. Attackers typically exploit this by manipulating execution order to trigger unpredictable behavior, such as privilege escalation or data corruption, by interleaving operations to bypass security checks or overwrite critical values. Developers mitigate this risk by implementing robust synchronization mechanisms, including mutexes, semaphores, or atomic operations, to ensure exclusive access during critical sections. Additionally, adopting thread-safe design patterns and minimizing shared state can significantly reduce the attack surface. By rigorously testing concurrent code paths and enforcing strict access controls, engineers prevent race conditions, ensuring application integrity and stability under high-concurrency scenarios.
$transfer_amount = GetTransferAmount(); $balance = GetBalanceFromDatabase(); if ($transfer_amount < 0) { FatalError("Bad Transfer Amount"); } $newbalance = $balance - $transfer_amount; if (($balance - $transfer_amount) < 0) { FatalError("Insufficient Funds"); } SendNewBalanceToDatabase($newbalance); NotifyUser("Transfer of $transfer_amount succeeded."); NotifyUser("New balance: $newbalance");In the following pseudocode, the attacker makes two simultaneous calls of the program, CALLER-1 and CALLER-2. Both callers are for the same user account. CALLER-1 (the attacker) is associated with PROGRAM-1 (the instance that handles CALLER-1). CALLER-2 is associated with PROGRAM-2. CALLER-1 makes a transfer request of 80.00. PROGRAM-1 calls GetBalanceFromDatabase and sets $balance to 100.00 PROGRAM-1 calculates $newbalance as 20.00, then calls SendNewBalanceToDatabase(). Due to high server load, the PROGRAM-1 call to SendNewBalanceToDatabase() encounters a delay. CALLER-2 makes a transfer reqvoid f(pthread_mutex_t *mutex) { pthread_mutex_lock(mutex); /* access shared resource */ pthread_mutex_unlock(mutex); }int f(pthread_mutex_t *mutex) { int result; result = pthread_mutex_lock(mutex); if (0 != result) return result; /* access shared resource */ return pthread_mutex_unlock(mutex); }Vulnerabilities classified as CWE-362 (使用共享资源的并发执行不恰当同步问题(竞争条件)) represent 596 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.