Multiple MediaTek chip sensorhub local privilege elevation vulnerabilities

MediaTek Inc. is the world's fourth largest fab semiconductor company and a market leader in mobile devices, smart home applications, wireless connectivity technologies and IoT products, with approximately 1.5 billion devices a year with MediaTek chips built into them available worldwide. Several...

Out-of-bounds

In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07129717; Issue ID: ALPS07129717...

MediaTek 芯片安全漏洞

MediaTek Inc. is the world's fourth largest fab semiconductor company and a market leader in mobile devices, smart home applications, wireless connectivity technologies and IoT products, with approximately 1.5 billion devices a year with MediaTek chips built into them available worldwide. Several...

CVE-2022-26474

In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07129717; Issue ID: ALPS07129717...

Incorrect volatility on range calculation

Lines of code Vulnerability details Impact Incorrect calculation of volatility impairs the adaptive swap fee calculation. Actual swap fees may be bigger or smaller than expected. Proof of Concept According to the Tech Paper, volatility during the period $\Delta t$ is calculated as follows:...

computeAddress does not follow the standard procedure to compute the address. The contract can not create pool for some pairs due to hash collision

Lines of code Vulnerability details Impact Poor source of randomness, an attacker can easily decipher the computed address. The contract can be easily tricked. This can cause hash collision, due to this, for some pairs, the contract can not create pool. Proof of Concept AlgebraFactory.solL123 : T...

Wrong balanceOf user after minting legendary gobbler

Lines of code Vulnerability details Impact In ArtGobblers.mintLegendaryGobbler function, line 458 calculates the number of gobblers user owned after minting // We subtract the amount of gobblers burned, and then add 1 to factor in the new legendary. getUserDatamsg.sender.gobblersOwned =...

withheld_amt calculation is done after minting frxETHToken tokens

Lines of code Vulnerability details Proof of concept The submit method in frxETHMinter.sol has the following code // Give the sender frxETH frxETHToken.mintermintrecipient, msg.value; // Track the amount of ETH that we are keeping uint256 withheldamt = 0; if withholdRatio != 0 withheldamt =...

recoverEther not updating currentWithheldETH breaks calculation of withheld amount for further deposits

Lines of code Vulnerability details The emergency exit function recoverEther allows the owner to retrieve the ETH in case an issue were to happen. The problem is that this function does not update currentWithheldETH. This means upon deposit starting again after the emergency recovery,...

First xERC4626 deposit can break the share calculation.

Lines of code Vulnerability details Impact New xERC4626 vault share price can be manipulated right after creation. Which give early depositor greater share portion of the vault during the first cycle. While deposit token also affected by rounding precision due to the exploit showed in the POC tha...

CVE-2022-36025

Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in...

CVE-2022-36025 Incorrect Conversion between Numeric Types in Besu Ethereum Client

Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An error in 32 bit signed and unsigned types in the calculation of available gas in the CALL operations including DELEGATECALL results in...

CVE-2022-39242 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices

Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can constru...

CVE-2022-39242 Incorrect Calculation in Frontier leads to inflated Ethereum chain gas prices

Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted as the block weight for all cases. In case of large EVM gas refunds, this can lead to block spamming attacks -- the adversary can constru...

Hyperledger Besu 安全漏洞

Hyperledger Besu is an open source application from Hyperledger. It is used to run, maintain, debug and monitor nodes in the Ethernet network. A security vulnerability exists in Hyperledger Besu versions prior to 22.1.3 through 22.7.1, which stems from an error in its 32-bit signed and unsigned...

PT-2022-23124 · Besu · Besu

Name of the Vulnerable Software and Affected Versions: Besu versions 22.1.4 through 22.7.0 Description: The issue is related to an incorrect conversion between numeric types in the calculation of available gas in CALL operations, including DELEGATECALL. This results in incorrect gas being passed...

Can overflow linear vest calculation and lock up funds

Lines of code Vulnerability details Impact If a Claim object for a user has a large enough vesting time and/or linear vesting amount, then that object can get into a state such that the calculations in baseVestedAmount overflow. If the baseVestedAmount calculations overflow, then the associated...

Wrong accounting logic when syncRewards() is called within beforeWithdraw makes withdrawals impossible

Lines of code Vulnerability details Impact sfrxETH.beforeWithdraw first calls the beforeWithdraw of xERC4626, which decrements storedTotalAssets by the given amount. If the timestamp is greater than the rewardsCycleEnd, syncRewards is called. However, the problem is that the assets have not been...

Overflow in amount calculation can lead to users not being able to withdraw their funds

Lines of code Vulnerability details Impact The amounts of token are saved in uint112 variables. The baseVestedAmount, which calculates the amount of token that was vested for the user given a timestamp, contains the following line that calculates the relative amount using the time passed from the...

error in calculation of vested amount

Lines of code Vulnerability details Impact The function vestedAmount can return a wrong value of vested amount. Proof of Concept The function vestedAmount calculates the vested amount of a recipient at a given time,referenceTs. The problem is that if the referenceTs is in the past and the user ha...