GSD-2022-1003931 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.284 by commit...

GSD-2022-1003815 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.248 by commit...

GSD-2022-1003663 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.199 by commit...

GSD-2022-1003462 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.123 by commit...

GSD-2022-1003197 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.48 by commit...

GSD-2022-1002527 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.5 by commit...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.308.9 - x86/speculation/mmio: Fix late microcode loading Patrick Colp Orabug: 34276099 5.4.17-2136.308.8 - Add debugfs for controlling MMIO state data Kanth Ghatraju Orabug: 34202259 CVE-2022-21123 CVE-2022-21125 CVE-2022-21127 CVE-2022-21166 - KVM: x86/speculation: Disable Fill buffe...

HPESBHF04320 rev.2 - Certain HPE ProLiant BL/DL/ML/XL/MicroServer and Apollo Servers Using Certain Intel Processors, INTEL-SA-00615, 2022.1 IPU – Intel Processors MMIO Stale Data Advisory, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4200 Gen10 Server - Prior to 2.6605172022 HPE ProLiant BL460c Gen10 Server Blade - Prior to 2.6606012022 HPE ProLiant DL20 Gen10 Server - Prior to 2.5804142022 HP...

CVE-2021-26400

AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memory, resulting in potential data leakage...

Chainlink's latestRoundData might return stale or incorrect results

Lines of code Vulnerability details Impact Chainlink's latestRoundData is used but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation: Proof of Concept...

Unchecked oracle return value

Lines of code Vulnerability details Impact The return value bool success of oracle.get calls is ignored. This could lead to stale data or incorrect prices due to oracle issues. Proof of Concept NFTPairWithOracle.solL287 Change to bool success, uint256 rate = loanParams.oracle.getaddressthis,...

Chainlink's latestRoundData might return stale or incorrect results

Lines of code Vulnerability details , int basePrice, , , = baseAggregator.latestRoundData; On ChainlinkPriceOracle.sol, we are using latestRoundData, but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation:...

Potentially Incomplete or Stale Data from Oracle

Lines of code Vulnerability details Impact Calls to the Chainlink price oracle via refreshedAssetPerBaseInUQ in ChainlinkPriceOracle.sol use the correct function latestRoundData per Chainlink's documentation, but lacks the recommended validations to ensure that the round is complete and does not...

Chainlink oracle data can be stale

Lines of code Vulnerability details Impact Oracle data can be stale which can lead to wrong calculations for balancing indexes. Proof of Concept When lastRoundData is called only price is pulled from the provided data. RoundId should be checked to ensure the data is updated. Recommended Mitigatio...

Chainlink's latestRoundData might return stale or incorrect results

Lines of code Vulnerability details Impact In ChainlinkPriceOracle.sol, latestRoundData is used but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation: Proof of Concept ChainlinkPriceOracle.solL83...

Chainlink oracle might return stale data

Lines of code Vulnerability details Impact Oracle might return stale data for basePrice and quotePrice. Proof of Concept refreshedAssetPerBaseInUQ in ChainlinkPriceOracle.sol does not check if the data from Chainlink is fresh . If there is a problem with the Chainlink oracle, this contract may be...

Use of deprecated oracle API in _collateralPriceUsd

Lines of code Vulnerability details Likelihood low, impact high. The Chainlink latestAnswer function included in IAggregatorV3Interface and called in FungibleAssetVaultForDAOcollateralPriceUsd is considered deprecated and no longer included in the Chainlink API documentation. It's considered best...

Chainlink pricer is using a deprecated API

Lines of code Vulnerability details Impact According to Chainlink's documentation, the latestAnswer function is deprecated. This function might suddenly stop working if Chainlink stop supporting deprecated APIs. And the old API can return stale data. Proof of Concept Tools Used None Recommended...

QA Report

1 Impact Light DoS of USDC withdrawal system Proof of Concept Currently, withdrawals are queued in an array and processed sequentially in a for loop. However, a user can post unlimited number of tiny 1 wei withdrawals. Clearing these withdrawals can be gas consuming and can delay users. It is gas...

Function getUnderlyingPrice in Oracle.sol does not check the price returned from chainlink aggregators

Lines of code Vulnerability details Impact The getUnderlyingPrice function in the contract Oracle.sol fetches the answer directly from a Chainlink aggregator using the latestRoundData function. There is no check if the return value is 0 or indicates stale data. This could lead to incorrect or sta...