187 matches found
kernel: md: fix a crash in mempool_free
In the Linux kernel, the following vulnerability has been resolved: md: fix a crash in mempoolfree There's a crash in mempoolfree when running the lvm test shell/lvchange-rebuild-raid.sh. The reason for the crash is this: superwritten calls atomicdecandtest&mddev-pendingwrites and...
Missing transaction expiration check result in asset tokens selling at a lower price
Lines of code Vulnerability details Impact Selling of asset tokens misses the transaction expiration check, which may lead to reward tokens being sold at a price that's lower than the market price at the moment of a swap. Proof of Concept The swapAsset function, which is responsible for selling...
kernel: NFS: Avoid writeback threads getting stuck in mempool_alloc()
In the Linux kernel, the following vulnerability has been resolved: NFS: Avoid writeback threads getting stuck in mempoolalloc In a low memory situation, allow the NFS writeback code to fail without getting stuck in infinite loops in mempoolalloc...
kernel: md: fix a crash in mempool_free
In the Linux kernel, the following vulnerability has been resolved: md: fix a crash in mempoolfree There's a crash in mempoolfree when running the lvm test shell/lvchange-rebuild-raid.sh. The reason for the crash is this: superwritten calls atomicdecandtest&mddev-pendingwrites and...
SfrxEth slippage and fee stealing
Lines of code Vulnerability details Impact The SfrxEth derivative contract calculates the maximum slippage for buying SfrxEth from curve pool by using the current price in the pool at runtime, without considering the price at which the user submitted the transaction to the mempool: uint256 minOut...
Reth griefing
Lines of code Vulnerability details Impact The maximum slippage when buying rETH from the Uniswap V3 pool is calculated in Reth derivative contract by taking the current price in the Uniswap V3 pool at runtime, without taking into account the price at which the user sent the transaction to the...
Swap deadline for Reth derivative cannot be specified and used for staking
Lines of code Vulnerability details Impact When calling the following Reth.deposit function, uint256 amountSwapped = swapExactInputSingleHopWETHADDRESS, rethAddress, 500, msg.value, minOut can be executed. Calling the Reth.swapExactInputSingleHop function below then calls...
Upgraded Q -> 2 from #298 [1677237168746]
Judge has assessed an item in Issue 298 as 2 risk. The relevant finding follows: 01 MALICIOUS USER, WHO OWNS SPLITTABLE FUNDS, CAN CALL DripsHub.setSplits FUNCTION TO FRONTRUN OTHER USER'S DripsHub.split FUNCTION CALL, WHICH CAN BREAK AGREEMENT BETWEEN THESE USERS Based on the current...
hash and signature_ can be obtained from the mempool when recoverSigner is executed
Lines of code Vulnerability details In the QuestFactory.sol contract, an attacker can monitor the mem pool and obtain the values of hash and signature which the other user has provided to the function Proof of Concept 210-213: function recoverSignerbytes32 hash, bytes memory signature public pure...
Baited by redemption during undercollateralization (no issuance, just transfer)
Lines of code Vulnerability details Impact This is similar to the "high" vulnerability I submitted, but also shows a similar exploit can be done if a user isn't a whale, and isn't issuing anything. A user can send a redeem TX and an evil actor can make it so they get almost nothing back during...
GSD-2023-1001274 md: fix a crash in mempool_free
md: fix a crash in mempoolfree This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit ae7793027766491c5f8635b12d15a5940d3b8698. For...
GSD-2023-1000968 nvme-pci: fix mempool alloc size
nvme-pci: fix mempool alloc size This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.87 by commit 9141144b37f30e3e7fa024bcfa0a13011e546ba9, it...
PT-2023-34351 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.163 Description: A potential security issue has been identified in the Linux Kernel, related to a crash in mempool free. The actual impact and attack plausibility have not yet been proven. Recommendations:...
MAL-2022-691 Malicious code in @uniswapv2/mempool (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 757bc76cb718365caf2a86ab75367434d84cf67593c31497d74ed11eb494d86e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GSD-2022-1005391 cifs: fix small mempool leak in SMB2_negotiate()
cifs: fix small mempool leak in SMB2negotiate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.66 by commit...
GSD-2022-1004960 cifs: fix small mempool leak in SMB2_negotiate()
cifs: fix small mempool leak in SMB2negotiate This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.19.8 by commit...
Newton's iteration convergence might not converge
Lines of code Vulnerability details Impact In getAmountOut for stable pair, Newton's method is used, however there is no check for the solution convergence. The numerical stability for Newton's method only applies to initial value close enough to the real solution. If the iteration fail to...
kernel: dm: fix mempool NULL pointer race when completing IO
In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when completing IO dmiodecpending calls endioacct first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to...
kernel: dm: fix mempool NULL pointer race when completing IO
In the Linux kernel, the following vulnerability has been resolved: dm: fix mempool NULL pointer race when completing IO dmiodecpending calls endioacct first and will then dec md in-flight pending count. But if a task is swapping DM table at same time this can result in a crash due to...
Griefing on claim()
Lines of code Vulnerability details Issue: griefing can happen if coolDownPeriod 0 due to the fact that you can stake for someone else. Whenever a stake happens, the expiry variable increases with coolDownPeriod. This can be done either by watching the mempool and frontrun a stake when someone...