kernel: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"

In the Linux kernel, the following vulnerability has been resolved: Revert "usb: typec: ucsi: add a common function ucsiunregisterconnectors" The recent commit 87d0e2f41b8c "usb: typec: ucsi: add a common function ucsiunregisterconnectors" introduced a regression that caused NULL dereference at...

The latest malt price can be less than the actual price target and StabilizerNode.stabilize will revert

Lines of code Vulnerability details Impact StabilizerNode.stabilize will revert when latestSample priceTarget and msgSender is not an admin and not whitelisted, it asserts livePrice minThreshold. And minThreshold is calculated as follows: uint256 priceTarget = maltDataLab.getActualPriceTarget;...

LinearDistributor.declareReward can revert due to dependency of balance

Lines of code Vulnerability details Impact LinearDistributor.declareReward will revert and it can cause permanent DOS. Proof of Concept In LinearDistributor.declareReward, if the balance is greater than the bufferRequirement, the rest will be forfeited. if balance bufferRequirement // We have mor...

SUSE CVE-2016-9645

The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing restriction bypass for git revert when using git versions older than 2.8.0. This has been fixed in 3.20161229...

SUSE CVE-2016-10026

ikiwiki 3.20161219 does not properly check if a revision changes the access permissions for a page on sites with the git and recentchanges plugins and the CGI interface enabled, which allows remote attackers to revert certain changes by leveraging permissions to change the page before the revisio...

Mitigation Confirmed for Mitigation of H-06 Issue mitigated

C4 issue H-06: MinipoolManager: node operator can avoid being slashed Comments In the original implementation, there were a few scenarios where malicious node operators can avoid being slashed. Mitigation PR 41 This PR includes mitigation for various issues H-03, H-06, M-13. Just focusing on the...

Unbreakable Enterprise kernel-container security update

5.15.0-7.86.6.1 - net/rds: Delegate fan-out to a background worker Gerd Rausch Orabug: 35051226 5.15.0-7.86.6 - runtime revert of virtionet: Stripe queue affinities across cores. Konrad Rzeszutek Wilk Orabug: 35001044 - rds: ib: Make sure messages that errors out also get unmapped Hakon Bugge...

Caller.callBatched doesn't enforce msg.value is equal to sum of call values

Lines of code Vulnerability details For each call in callBatched, we pass a value to be sent along with the call: for uint256 i = 0; i calls.length; i++ Call memory call = callsi; returnDatai = callsender, call.to, call.data, call.value; The sum of the values of the calls should be equal to...

Other users cannot help a CIDNFT holder add subprotocols to the NFT

Lines of code Vulnerability details Impact Other users cannot approve and help CIDNFT holders add subprotocols to the NFT, breaking protocol specifications. Proof of Concept In the video walkthrough, around the 8 minute mark, it is mentioned that users can help NFT holders add subprotocols to the...

MinipoolManager: node operator can avoid being slashed

Lines of code Vulnerability details Impact When staking is done, a Rialto multisig calls MinipoolManager.recordStakingEnd . If the avaxTotalRewardAmt has the value zero, the MinipoolManager will slash the node operator's GGP. The issue is that the amount to slash can be greater than the GGP balan...

Upgraded Q -> 2 from #854 [1675461747744]

Judge has assessed an item in Issue 854 as 2 risk. The relevant finding follows: When the protocol is paused, all the multisigs are disabled:, However, it is still possible to call startRewardsCycle in the RewardsPool, however, the execution will revert because the enabled count is 0: --- The tex...

Fee on transfer tokens will not behave as expected

Lines of code Vulnerability details Impact In Numoen, it does not specifically restrict the type of ERC20 collateral used for borrowing. If fee on transfer tokens is/are entailed, it will specifically make mint revert in Lendgine.sol when checking if balanceAfter balanceBefore + collateral. Proof...

The LendgineRouter.burn() will always REVERT due to the callback function forgot to send the due token0 back.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The LendgineRouter.burn will always REVERT due to the callback function forgot to send the due token0 back. The callback function pairMintCallback is supposed to send back amount0 amount of token0 back ...

Burn will not work if positions below to different owners

Lines of code Vulnerability details Impact When an option is created, the caller has an option of choosing any address to mint these three option positions to long0, long1, short or if the caller chooses the options can be added for the caller alone . The positons could be transferred through...

USN-5822-2 samba regression

USN-5822-1 fixed vulnerabilities in Samba. The update for Ubuntu 20.04 LTS introduced regressions in certain environments. Pending investigation of these regressions, this update temporarily reverts the security fixes. We apologize for the inconvenience. Original advisory details: It was discover...

TimeswapV2LiquidityToken: collect() will always revert because it uses the wrong parameters when calling ITimeswapV2Pool.transferFees()

Lines of code Vulnerability details Proof of Concept collect uses the wrong paramenters when calling ITimeswapV2Pool.transferFees. It uses long0Fees, long1Fees, and shortFees instead of param.long0FeesDesired, param.long1FeesDesired, and param.shortFeesDesired. The former 3 are defined in the...

The _verifyTime function only reverts if revertOnInvalid is true and the order is not active.

Lines of code Vulnerability details Impact The verifyTime function only reverts if revertOnInvalid is true and the order is not active. This means that if revertOnInvalid is not passed or is false, the function will not revert even if the order is not active. It could have a significant impact on...

Upgraded Q -> M from #445 [1674423223201]

Judge has assessed an item in Issue 445 as M risk. The relevant finding follows: 5 Function crossChain in GovNFT should have limit for maximum tokens allowed to be transferred, because of gas limit in the dest chain. if a user transferred a lot of tokens because there was two loop inside each oth...

Unhandled Revert in _performERC721Transfer Function Resulting in Loss of Tokens

Lines of code Vulnerability details Impact The performERC1155BatchTransfers function could lead to a loss of tokens if the safeBatchTransferFrom function reverts and the code does not properly handle the revert. This can be exploited by an attacker who can call the performERC1155BatchTransfers...

Unhandled Revert in _performERC721Transfer Function Resulting in Loss of Tokens.

Lines of code Vulnerability details Impact transferFrom function is used to transfer ownership of ERC721 tokens from one address to another. If this function reverts, it means that the transfer failed, and the ownership of the tokens should not be changed. However, the code in the...