PT-2022-35905

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.331 Description The issue is related to a test spinlock on the panic path, which could potentially lead to lockups. The actual impact and attack plausibility have not yet been proven. Recommendations For Lin...

PT-2022-34908

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v6.0.7 Description The issue is related to the kmemleak scan function in the Linux Kernel, which may cause a soft lockup in object iteration loops. The actual impact and attack plausibility have not yet been...

Permanent lockup of tokens without recovery possible

Lines of code Vulnerability details Impact The callhook for whitelisted contracts adds an additional layer of complexity that can have multiple points of failure. If the execution of L2GraphTokenGateway.finalizeInboundTransfer fails indefinitely, there is currently no way to recover the...

ALPINE-CVE-2022-33748

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

CVE-2022-33748: Improper Handling of Exceptional Conditions

lock order inversion in transitive grant copy handling As part of XSA-226 a missing cleanup call was inserted on an error handling path. While doing so, locking requirements were not paid attention to. As a result two cooperating guests granting each other transitive grants can cause locks to be...

Delegate can force users, who delegate to them, to increase their lock end

Lines of code Vulnerability details Impact If a user has votes delegated to them, they can force all users who delegated to them to increase their lock time with minimal negative effects to themselves. In my PoC, I prove that a user can lock minimal value and manipulate the users who delegated to...

A delegatee can frontrun the delegator's call to increaseUnlockTime to prevent the delegator to withdraw or quitlock

Lines of code Vulnerability details Impact Charlie and Alice both create a lock, with Alice's lock being longer than Charlie's. Charlie then delegates to Alice. At this point, if Charlie wants to unlock his tokens he can call withdraw or quitLock, but not with a delegation in place see 1, 2, so h...

Failed transfer during migrate could lockup the fund in old terminal

Lines of code Vulnerability details Without require for boolean checking, if to.addToBalanceOfvalue: payableValueprojectId, balance, token, '', bytes''; fail when transfer, migrate will not revert. This could cause the fund to lockup in the old terminal since store.recordMigrationprojectId; will...

WS-2022-0135

PocketMine-MP caps maximum chat message length at 512 Unicode characters, or about 2048 bytes. No more than 2 chat messages may be sent per tick. However, due to legacy reasons, incoming chat message blobs are split by "\n", and each part is treated as a separate message, the length of each part ...

Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.4-2022-006 (ALASKERNEL-5.4-2022-006)

The version of kernel installed on the remote host is prior to 5.4.141-67.229. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-006 advisory. A flaw was found in the Linux kernel. This flaw allows attackers to cause a denial of service soft lockup b...

GSD-2022-1002480 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.311 by commit...

GSD-2022-1002409 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.276 by commit...

GSD-2022-1002321 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.238 by commit...

GSD-2022-1002198 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.4.189 by commit...

GSD-2022-1002009 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.111 by commit...

GSD-2022-1001731 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.34 by commit...

GSD-2022-1001405 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.20 by commit...

GSD-2022-1001067 iommu/arm-smmu-v3: fix event handling soft lockup

iommu/arm-smmu-v3: fix event handling soft lockup This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.3 by commit...

PT-2022-30004

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.34 Description The issue is related to event handling soft lockup in iommu/arm-smmu-v3. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to...

PT-2022-30682

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.276 Description The issue is related to event handling in the iommu/arm-smmu-v3 component, which may cause a soft lockup. The actual impact and attack plausibility have not yet been proven. Recommendations...