CVE-2024-57946

In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de "virtio-blk: Ensure no requests in virtqueues before deleting vqs." replaces queue quiesce with queue freeze in virtio-blk's PM callbacks. And the...

CVE-2024-53689

In the Linux kernel, the following vulnerability has been resolved: block: Fix potential deadlock while freezing queue and acquiring sysfslock For storing a value to a queue attribute, the queueattrstore function first freezes the queue -qusagecounterio and then acquire -sysfslock. This seems not...

CVE-2024-53689

CVE-2024-53689 pertains to the Linux kernel and describes a deadlock risk in the queue handling path. The root cause is an incorrect ordering in the block: the code freezes the queue (via q_usage_counter) before acquiring sysfs_lock, whereas the typical safe order is to acquire sysfs_lock prior t...

CVE-2024-56553

CVE-2024-56553 is a Linux kernel memory-leak fix in the binder subsystem. The issue occurred when a freeze notification is cleared (BC_CLEAR_FREEZE_NOTIFICATION) before binder_freeze_notification_done(), leaving entries in proc->delivered_freeze queued and leaking on process exit. The patch en...

Target Device Performance and Freezing Issues While Patched into a Cisco Catalyst Line of Switches

Target devices experience intermittent freezing behavior and poor performance while patched into a Cisco Catalyst line of switches...

LockBit Ransomware Operation Shut Down; Criminals Arrested; Decryption Keys Released

The U.K. National Crime Agency NCA on Tuesday confirmed that it obtained LockBit's source code as well as a wealth of intelligence pertaining to its activities and their affiliates as part of a dedicated task force called Operation Cronos. "Some of the data on LockBit's systems belonged to victim...

Citrix Provisioning Target Poor Performance And Slow Boot

Target Devices appear to boot slowly and hang or remain stuck at a black screen shortly after power on. Other devices that are up and running can be found frozen. These machines might be found "unregistered" in Studio and you cannot RDP or console into them. PVS servers may be reporting DB Offlin...

check that the default consoleFallbackHandler and SafeModerator have not been changed after executing every transaction by the executors and the operator will always revert and freeze all the functionality of the sub account if the owners of console account have changed this addresses

Lines of code Vulnerability details Impact this vulnerability will lead to freeze all the functionality of the sub account and revert on all the transaction . Proof of Concept the main console is allowed to change the guard of the sub accounts and the fallback handler of the sub accounts , but if...

pacificfreezing.com Cross Site Scripting vulnerability OBB-3433093

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Extraordinary proposal can become stuck

Lines of code Vulnerability details Since standard and extraordinary proposals use the same treasury funds accounting variables and extraordinary voting period is long enough 1 month, it is possible that extraordinary proposal that was valid and gained enough votes will end up frozen: it might no...

Real Furnace and StRSR addresses can be added to the Distributor

Lines of code Vulnerability details Impact RToken may be distributed to StRSR and frozen. RSR may be distributed to Furnace and frozen. Proof of Concept Both Furnace and StRSR are added to the destinations of Distributor in DistributorP1init: function initIMain main, RevenueShare calldata dist...

Identity thieves bypass security questions to access Experian credit reports

After a tip from a Telegram user who frequented identity theft channels, Brian Krebs tested and confirmed that anyone who knew your name, address, social security number SSN, and birthday could view your full credit report at Experian. Skipping security questions The method to get access did not...

Destruction of the SmartAccount implementation

Lines of code Vulnerability details Description If the SmartAccount implementation contract is not initialized, it can be destroyed using the following attack scenario: Initialize the SmartAccount implementation contract using the init function. Execute a transaction that contains a single...

In case the winner is the address(0)

Lines of code Vulnerability details Impact Temporary freezing NFT this can be more than one period Proof of Concept On VRFNFTRandomDraw.fulfillRandomWords 254 request.currentChosenTokenId = 255 randomWords0 % tokenRange + 256 settings.drawingTokenStartId; In case ownerOfrequest.currentChosenToken...

Multi Step upgrades introduce security risk

Lines of code Vulnerability details Impact If Governor upgrades the system using executeDiamondCutProposal function then freezing is removed. This could be a problem where Governor was still not ready to make freezable facet available as shown in POC Proof of Concept 1. Governor discovers a...

ALSA-2022:5564 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: race condition in perfeventopen leads to privilege escalation CVE-2022-1729 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other...

CNote balance can be affected by griefing attack

Lines of code Vulnerability details Functions borrowFresh, repayBorrowFresh, mintFresh, redeemFresh require CNote balance to be strictly zero, reverting unconditionally otherwise. However, as CNote is ERC20 with usual transfer functionality, anyone can send a cNote tokens to the contract itself,...

Wrong implementation of rescueETH, causing the fees in native tokens to be frozen in the contract

Lines of code Vulnerability details /// @dev used for rescuing exchange fees paid to the contract in ETH function rescueETHaddress destination external payable onlyOwner bool sent, = destination.callvalue: msg.value''; requiresent, 'failed'; Recommendation Change to: /// @dev used for rescuing...

GHSA-PQWC-3VHW-QCVQ shvl vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. Details The NPM module 'shvl' can be abused by Prototype Pollution vulnerability since the function 'set' did not check for the...

GHSA-V2RH-5V88-RGVH Moodle context freezing

A vulnerability was found in moodle before version 3.6.3. The getwithcapabilityjoin and getusersbycapability functions were not taking context freezing into account when checking user capabilities...