895
Reference Description
CVE-2007-5794 Race condition in library function could cause data to be sent to the wrong
process.
https://www.cve.org/CVERecord?id=CVE-2007-5794
CVE-2007-3970 Race condition in file parser leads to heap corruption.
https://www.cve.org/CVERecord?id=CVE-2007-3970
CVE-2008-5021 chain: race condition allows attacker to access an object while it is still being
initialized, causing software to access uninitialized memory.
https://www.cve.org/CVERecord?id=CVE-2008-5021
CVE-2009-4895 chain: race condition for an argument value, possibly resulting in NULL
dereference
https://www.cve.org/CVERecord?id=CVE-2009-4895
CVE-2009-3547 chain: race condition might allow resource to be released before operating on
it, leading to NULL dereference
https://www.cve.org/CVERecord?id=CVE-2009-3547
CVE-2006-5051 Chain: Signal handler contains too much functionality (CWE-828), introducing
a race condition (CWE-362) that leads to a double free (CWE-415).
https://www.cve.org/CVERecord?id=CVE-2006-5051
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
MemberOf 751 2009 Top 25 - Insecure Interaction Between
Components
750 2352
MemberOf 801 2010 Top 25 - Insecure Interaction Between
Components
800 2354
MemberOf 852 The CERT Oracle Secure Coding Standard for Java
(2011) Chapter 9 - Visibility and Atomicity (VNA)
844 2366
MemberOf 867 2011 Top 25 - Weaknesses On the Cusp 900 2372
MemberOf 877 CERT C++ Secure Coding Section 09 - Input Output
(FIO)
868 2377
MemberOf 882 CERT C++ Secure Coding Section 14 - Concurrency
(CON)
868 2380
MemberOf 988 SFP Secondary Cluster: Race Condition Window 888 2412
MemberOf 1003 Weaknesses for Simplified Mapping of Published
Vulnerabilities
1003 2576
MemberOf 1142 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 08. Visibility and Atomicity (VNA)
1133 2448
MemberOf 1364 ICS Communications: Zone Boundary Failures 1358 2501
MemberOf 1365 ICS Communications: Unreliability 1358 2502
MemberOf 1366 ICS Communications: Frail Security in Protocols 1358 2503
MemberOf 1376 ICS Engineering (Construction/Deployment): Security
Gaps in Commissioning
1358 2512
MemberOf 1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous
Software Weaknesses
1387 2597
MemberOf 1401 Comprehensive Categorization: Concurrency 1400 2526
MemberOf 1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous
Software Weaknesses
1425 2600
CWE Version 4.14
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race
Condition')
CWE-362: Concurrent Execution using Shared Resource
with Improper Synchronization ('Race Condition') 896
Notes
Maintenance
The relationship between race conditions and synchronization problems (CWE-662) needs to be
further developed. They are not necessarily two perspectives of the same core concept, since
synchronization is only one technique for avoiding race conditions, and synchronization can be
used for other purposes besides race condition prevention.
Research Gap
Race conditions in web applications are under-studied and probably under-reported. However, in
2008 there has been growing interest in this area.
Research Gap
Much of the focus of race condition research has been in Time-of-check Time-of-use (TOCTOU)
variants (CWE-367), but many race conditions are related to synchronization problems that do
not necessarily require a time-of-check.
Research Gap
From a classification/taxonomy perspective, the relationships between concurrency and program
state need closer investigation and may be useful in organizing related issues.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Race Conditions
The CERT Oracle Secure
Coding Standard for Java
(2011)
VNA03-J Do not assume that a group of calls
to independently atomic methods is
atomic
Related Attack Patterns
CAPEC-ID Attack Pattern Name
26 Leveraging Race Conditions
29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
References
[REF-44]Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security".
McGraw-Hill. 2010.
[REF-349]Andrei Alexandrescu. "volatile - Multithreaded Programmer's Best Friend". Dr. Dobb's.
2008 February 1. < https://drdobbs.com/cpp/volatile-the-multithreaded-programmers-b/184403766
>.2023-04-07.
[REF-350]Steven Devijver. "Thread-safe webapps using Spring". < https://web.archive.org/
web/20170609174845/http://www.javalobby.org/articles/thread-safe/index.jsp >.2023-04-07.
[REF-351]David Wheeler. "Prevent race conditions". 2007 October 4. < https://www.ida.liu.se/
~TDDC90/literature/papers/SP-race-conditions.pdf >.2023-04-07.
[REF-352]Matt Bishop. "Race Conditions, Files, and Security Flaws; or the Tortoise and the
Hare Redux". 1995 September. < https://seclab.cs.ucdavis.edu/projects/vulnerabilities/scriv/ucdecs-
95-08.pdf >.2023-04-07.
[REF-353]David Wheeler. "Secure Programming for Linux and Unix HOWTO". 2003 March 3. <
https://dwheeler.com/secure-programs/Secure-Programs-HOWTO/avoid-race.html >.2023-04-07.
[REF-354]Blake Watts. "Discovering and Exploiting Named Pipe Security Flaws for Fun and Profit".
2002 April. < https://www.blakewatts.com/blog/discovering-and-exploiting-named-pipe-securityflaws-
for-fun-and-profit >.2023-04-07.
CWE Version 4.14
CWE-363: Race Condition Enabling Link Following
CWE-363: Race Condition Enabling Link Following