LTESniffer - An Open-source LTE Downlink/Uplink Eavesdropper

LTESniffer is An Open-source LTE Downlink/Uplink Eavesdropper It first decodes the Physical Downlink Control Channel PDCCH to obtain the Downlink Control Informations DCIs and Radio Network Temporary Identifiers RNTIs of all active users. Using decoded DCIs and RNTIs, LTESniffer further decodes t...

Failure to Initialize Default Price Feeds Can Cause Unexpected Reverts

Lines of code Vulnerability details Impact The ChainlinkPriceOracle contract does not initialize default price feed mappings for supported assets. This means calling the getAssetPrice function before explicitly setting a feed will result in a revert instead of a defined failure response. Details:...

kernel: drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leak in kfdmemdmamapuserptr If the number of pages from the userptr BO differs from the SG BO then the allocated memory for the SG table doesn't get freed before returning -EINVAL, which may lead to a memor...

kernel: net/mlx5e: TC, Fix using eswitch mapping in nic mode

A flaw was found in the Linux kernel net/mlx5e Ethernet driver’s traffic control handling code. Under certain configurations when operating in NIC mode, the driver erroneously uses the eswitch object mapping pool, which is not initialized in that mode. This can lead to an invalid mapping referenc...

kernel: x86/mm: Randomize per-cpu entry area

A possible unauthorized memory access flaw was found in the Linux kernel cpuentryarea mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. This issue could allow a local user to gain access to some important data with expected locatio...

CVE-2023-47128 piccolo SQL Injection via named transaction savepoints

Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...

CVE-2023-47128

Piccolo ORM (Python) before 1.1.1 is vulnerable to SQL injection via named transaction savepoints. The root cause is building and executing SAVEPOINT commands with user-supplied input using f-strings, which can lead to arbitrary read/modify operations and even server compromise per the descriptio...

CVE-2023-47128 piccolo SQL Injection via named transaction savepoints

Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an end developer exposing a savepoints name...

kernel: iommufd: Check for uptr overflow

A flaw was found in the iommufd subsystem of the Linux kernel. When setting up a mapping with a user virtual address that wraps past zero or otherwise triggers a pointer/size overflow, the kernel may fail to properly validate and constrain the user-provided values. This can result in a buffer...

kernel: net/mlx5e: TC, Fix using eswitch mapping in nic mode

A flaw was found in the Linux kernel net/mlx5e Ethernet driver’s traffic control handling code. Under certain configurations when operating in NIC mode, the driver erroneously uses the eswitch object mapping pool, which is not initialized in that mode. This can lead to an invalid mapping referenc...

kernel: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error device address=0x00000002a3ff38d8...

kernel: wifi: ath11k: fix deinitialization of firmware resources

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11kahbfwresourcesinit, iommu domain mapping is done only for the chipsets having fixed firmware memory. Also, for such chipsets, mapping is done only if it...

kernel: x86/mm: Randomize per-cpu entry area

A possible unauthorized memory access flaw was found in the Linux kernel cpuentryarea mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. This issue could allow a local user to gain access to some important data with expected locatio...

kernel: irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init()

In the Linux kernel, the following vulnerability has been resolved: irqchip/wpcm450: Fix memory leak in wpcm450aicofinit If ofiomap failed, 'aic' should be freed before return. Otherwise there is a memory leak...

kernel: Linux kernel: Denial of Service in vfio/type1 due to locked_vm underflow

A flaw was found in the Linux kernel's vfio/type1 module. A local user could exploit this vulnerability when a vfio container is preserved across an exec call. If the user unmaps a Direct Memory Access DMA mapping, the lockedvm counter can underflow. This underflow can cause subsequent DMA map...

Upgraded Q -> 2 from #345 [1699029532851]

Judge has assessed an item in Issue 345 as 2 risk. The relevant finding follows: Low-01 When a User-1 sell/transfer a safe to User-2, during transfer allowance is not clear in case of User-1 safeCan is a mapping which set allowance for other addresses, by which they can perform action on behalf o...

replay exploitation in StakedUSDeV2's unstake function

Lines of code Vulnerability details Impact The vulnerability in the unstake function of the StakedUSDeV2 contract allows the receiver to claim assets without considering the specific round from which they should receive the assets. The receiver can claim assets from a different round than intende...

at _modifyCollateralBalance when locking and generating debt your wad is going to be negative number but at the token Collateral mapping should not have any negative numbers

Lines of code Vulnerability details Impact the protocol will not work, all functions will not work Proof of Concept you cannot set negative number to uint256 Tools Used manual Recommended Mitigation Steps change the mapping to : mappingbytes32 cType = mappingaddress safe = int256 wad public...

Nonce update

Lines of code Vulnerability details return uint256keccak256abi.encodePackedownersHash, ownerSafeCountownersHash++, salt, VERSION; here ownerSafeCountownersHash++ is used as nonce for different ownerSafeCount mapping if ownersHash is 0 or 1 the mapping will be 0 for the first item.This will cause ...

CoreRootRouter._setLocalToken FUNCTION COULD OVERWRITE THE EXISTING VALUES OF THE getLocalTokenFromGlobal MAPPING VALUES DUE TO LACK OF CONDITIONAL CHECKS

Lines of code Vulnerability details Impact The CoreRootRouter.setLocalToken function is used to set the local token on a specific chain for a global token. The function initially checks whether the local token is is already added as shown below: if IPortrootPortAddress.isLocalTokenlocalAddress,...