Upgraded Q -> M from #215 [1668468272191]

Judge has assessed an item in Issue 215 as M risk. The relevant finding follows: 7. No max fee is set on setFlashLoanFee function There is no max fee set. This allows a malicious owner to set a very high amount of flashloan fee , which allows the malicious admin to grief other users. He can also...

PT-2022-35554 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.150 Description: The issue is related to a platform-device leak in the bridge platform create function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel...

PT-2022-35220 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.15.77 Description: The issue is related to memory corruption with too many bridges in the drm/msm/dsi component. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

PT-2022-35879 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.9.332 Description: A possible memory leak was identified in the ehea register port function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versions prio...

Intel Hyperscan 缓冲区错误漏洞

Intel Hyperscan is a high-performance multi-regular expression matching library from Intel Corporation USA. A security vulnerability exists in versions of Intel Hyperscan prior to 2022/4/29, which stems from improperly limiting buffers. An attacker could exploit the vulnerability to escalate...

## Potential for loops hitting the block gas limit

Lines of code Vulnerability details Proof of Concept A malicious/compromised LineOfCredit arbiter can add a huge amount of collaterals to the Escrow by calling enableCollateral. This method pushes each collateral token to an array that is then iterated over in getCollateralValue. If the array siz...

Unlimited length of LineOfCredit.ids: storage collisions

Lines of code Vulnerability details Impact There are no restrictions for ids length So malicious borrower may create many credits and replace storage slot data at some position Proof of Concept 1. LineOfCredit.ids saves array size in slot Oracle data feed is insufficiently validated in Oracle.sol...

Potential DoS when closing a credit nominated in ETH in the LineOfCredit contract

Lines of code Vulnerability details When closing a credit that was issued in ETH, the LineOfCredit contract will send the lender his deposit and any accrued interests using the address.transferamount function, which may fail and revert the whole function, leading to an eventual DoS. Impact The...

useAndRepay function can be used to underflow the principal debt of a credit

Lines of code Vulnerability details The function useAndRepay present in the SpigotedLine contract doesn't check that the amount is within the debt limit and can be used by a malicious lender to underflow the principal variable and manipulate the debt of a credit. Impact A malicious lender can use...

Amazon Linux 2 : dbus (ALAS-2022-1870)

The version of dbus installed on the remote host is prior to 1.10.24-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1870 advisory. A flaw was found in dbus. The implementation of DBUSCOOKIESHA1 is susceptible to a symbolic link attack. A malicious client...

httpd: core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

A flaw was found in httpd, where it incorrectly limits the value of the LimitXMLRequestBody option. This issue can lead to an integer overflow and later causes an out-of-bounds write...

httpd: mod_lua: DoS in r:parsebody

A flaw was found in the modlua module of httpd. A malicious request to a Lua script that calls parsebody0 can lead to a denial of service due to no default limit on the possible input size...

kernel: ALSA: oss: Fix PCM OSS buffer allocation overflow

In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer allocation overflow We've got syzbot reports hitting INTMAX overflow at vmalloc allocation that is called from sndpcmplugalloc. Although we apply the restrictions to input parameters, it's based only...

Denial of Service (DoS)

Overview apple/swift-nio-extras is an useful code around SwiftNIO. Affected versions of this package are vulnerable to Denial of Service DoS. When using the .size decompression limit, request & response decompression checks the size of compressed instead of decompressed bytes. Details Denial of...

Unchecked array lenght

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Description Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitude higher...

Unchecked array length of the public_inputs[] in Verifier.sol

Lines of code Vulnerability details Impact If an array enumerates all registered addresses, an adversary can register many addresses, causing the problem described above. Vulnerability Details Ethereum is a very resource-constrained environment. Prices per computational step are orders of magnitu...

GHSA-9398-5GHF-7PR6 conduit-hyper vulnerable to Denial of Service from unchecked request length

Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::tobytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request. In version 0.4.2,...

RUSTSEC-2022-0066 Denial of Service from unchecked request length

Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::tobytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request. In version 0.4.2,...

Denial of Service from unchecked request length

Prior to version 0.4.2, conduit-hyper did not check any limit on a request's length before calling hyper::body::tobytes. An attacker could send a malicious request with an abnormally large Content-Length, which could lead to a panic if memory allocation failed for that request. In version 0.4.2,...

PT-2022-24876 · Unknown · Conduit-Hyper

Name of the Vulnerable Software and Affected Versions: conduit-hyper versions prior to 0.4.2 Description: The issue arises from conduit-hyper not checking any limit on a request's length before calling hyper::body::to bytes. An attacker could send a malicious request with an abnormally large...