GHSA-M2V9-W374-5HJ9 vyper default functions don't respect nonreentrancy keys

Summary Prior to v0.3.0, default functions did not respect the @nonreentrancy decorator and the lock was not emitted. This is a known bug and was already visible in the issue tracker https://github.com/vyperlang/vyper/issues/2455, but it is being re-issued as an advisory so that tools relying on...

vyper default functions don't respect nonreentrancy keys

Summary Prior to v0.3.0, default functions did not respect the @nonreentrancy decorator and the lock was not emitted. This is a known bug and was already visible in the issue tracker https://github.com/vyperlang/vyper/issues/2455, but it is being re-issued as an advisory so that tools relying on...

CVE-2024-32648

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions don't respect nonreentrancy keys and the lock isn't emitted. No vulnerable production contracts were found. Additionally, using a lock on a default function is a very sparsely...

PT-2024-26834

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A potential deadlock in the cifs sync mid result function has been resolved. The issue was spotted by Coverity, which identified a thread deadlock due to lock ordering. The problem occurs when...

PT-2024-24741

Name of the Vulnerable Software and Affected Versions Vyper versions prior to 0.3.0 Description The issue concerns the default function not respecting the @nonreentrancy decorator, and the lock not being emitted. This is a known bug with low impact, as using a lock on a default function is a...

PT-2024-26835

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description A missing lock when picking a channel in the smb3 module of the Linux kernel has been identified. This issue was spotted by Coverity, which reported a data race condition due to the missing loc...

CVE-2024-26923

CVE-2024-26923 in the Linux kernel exposes a race in the AF_UNIX garbage collector during connect() handling. An embryo enqueued during GC may be reachable via a peer with SCM_RIGHTS, causing two consecutive scan passes to observe different child sets and inflate the inflight count, which can lea...

April 23, 2024—KB5036979 (OS Build 19045.4355) Preview

None None...

The vulnerability of the MessagePack NodeJS/JavaScript msgpackr implementation allows a hacker to cause a service failure.

The vulnerability of the MessagePack NodeJS/JavaScript msgpackr implementation lies in the ability for users to execute suspended threads, creating messages that lock the decoder. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

SUSE CVE-2024-26854

In the Linux kernel, the following vulnerability has been resolved: ice: fix uninitialized dplls mutex usage The pf-dplls.lock mutex is initialized too late, after its first use. Move it to the top of icedpllinit. Note that the "errexit" error path destroys the mutex. And the mutex is the last...

DEBIAN-CVE-2024-26886

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: afbluetooth: Fix deadlock Attemting to do socklock on .recvmsg may cause a deadlock as shown bellow, so instead of using socksock this uses skreceivequeue.lock on btsockioctl to avoid the UAF: INFO: task kworker/u9:1:1...

CVE-2024-26874

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtkdrmcrtcfinishpageflip It's possible that mtkcrtc-event is NULL in mtkdrmcrtcfinishpageflip. pendingneedsvblank value is set by mtkcrtc-event, but in mtkdrmcrtcatomicflush, it's is not...

UBUNTU-CVE-2024-26886

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: afbluetooth: Fix deadlock Attemting to do socklock on .recvmsg may cause a deadlock as shown bellow, so instead of using socksock this uses skreceivequeue.lock on btsockioctl to avoid the UAF: INFO: task kworker/u9:1:1...

CVE-2024-26837 net: bridge: switchdev: Skip MDB replays of deferred events on offload

In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping...

CVE-2024-26837 net: bridge: switchdev: Skip MDB replays of deferred events on offload

In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, generation of the list of MDB events to replay would race against the creation of new group memberships, either from the IGMP/MLD snooping...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a potential deadlock problem with &fip-ctlrlock...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel. An attacker exploiting the vulnerability causes continuous hard-lock warnings and system hangs...

PT-2024-21544

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition in the Linux kernel can cause data corruption. The issue occurs when the invalidate mapping pages function fails to invalidate a meta inode page due to lock failure or...

SUSE CVE-2021-47195

In the Linux kernel, the following vulnerability has been resolved: spi: fix use-after-free of the addlock mutex Commit 6098475d4cb4 "spi: Fix deadlock when adding SPI controllers on SPI buses" introduced a per-controller mutex. But mutexunlock of said lock is called after the controller is alrea...

SUSE CVE-2024-26806

In the Linux kernel, the following vulnerability has been resolved: spi: cadence-qspi: remove system-wide suspend helper calls from runtime PM hooks The -runtimesuspend and -runtimeresume callbacks are not expected to call spicontrollersuspend and spicontrollerresume. Remove calls to those in the...