Missing Synchronization
CWE-820
The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0.
Latest Missing Synchronization vulnerabilities
- 7.5 High severity
hoverfly: Concurrent Execution using Shared Resource with Improper Synchronization
Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the `AddDiff()` function writes to the shared `responsesDiff` map without any synchronization (no mutex). When multiple proxy requests are processed
- 8.8 High severity
Linux: Improper Synchronization
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation walk_s1() and kvm_walk_nested_s2() expect to be called while holding kvm->srcu to guard against memslot
- 7.8 High severity
Linux: Missing Synchronization
In the Linux kernel, the following vulnerability has been resolved: mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists in
- 7.8 High severity
Graphics DDK: Missing Synchronization
Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages. The product utilises a shared resource in a con
- 7.4 High severity
Windows: Missing Synchronization
The on-endpoint Microsoft vulnerable driver blocklist is not fully synchronized with the online Microsoft recommended driver block rules. Some entries present on the online list have been excluded from the on-endpoint blocklist longer than the expected periodi
- 9.0 Critical severity
Ladybird: Missing Synchronization
LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attackers to execute arbitrary code via a crafted .js file. NOTE: the GitHub README says "Ladybird is in a pr
- 7.5 High severity
RTU500: Missing Synchronization
A vulnerability exists in RTU IEC 61850 client and server functionality that could impact the availability if renegotiation of an open IEC61850 TLS connection takes place in specific timing situations, when IEC61850 communication is active. Precondition is tha