GSD-2021-1002187 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15 by commit a46044a92add6a400f4dada7b943b30221f7cc80, i...

GSD-2021-1002118 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.15 by commit 4e5d794a2743f5a1e13ee1066ce37711f2696044...

UVI-2021-1002118 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.15 by commit 4e5d794a2743f5a1e13ee1066ce37711f2696044...

GSD-2021-1002054 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.76 by commit 188907c252188ac7a5ec3efcfa31dae1f47b8a20...

UVI-2021-1002054 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.76 by commit 188907c252188ac7a5ec3efcfa31dae1f47b8a20...

PT-2021-30583

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.14 through v5.14.14 Description The issue is related to the zpci zdev put function on reserve. The actual impact and attack plausibility have not yet been proven. It was introduced in version v5.14 and fixed in version...

UVI-2021-1001866 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.14.15 by commit 4e5d794a2743f5a1e13ee1066ce37711f2696044...

GSD-2021-1001833 s390/pci: fix zpci_zdev_put() on reserve

s390/pci: fix zpcizdevput on reserve This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.76 by commit 188907c252188ac7a5ec3efcfa31dae1f47b8a20...

PT-2021-30331

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.14 through v5.14.14 Description The issue is related to the zpci zdev put function on reserve. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions v5.14 through...

PT-2021-26303

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 5.10.61 through 5.10.75 Description: The issue is related to the s390/pci component, specifically the zpci zdev put function on reserve. The actual impact and attack plausibility have not yet been proven. Recommendations...

Wrong subtraction from reserve in burn

Handle pauliax Vulnerability details Impact function burn should subtract amount0 and amount1, not only fees from reserve0 and reserve1 here as whole amounts are withdrawn: reserve0 -= uint128amount0fees; reserve1 -= uint128amount1fees; Recommended Mitigation Steps reserve0 -= uint128amount0;...

Burning does not update reserves

Handle cmichel Vulnerability details The ConcentratedLiquidityPool.burn function sends out amount0/amount1 tokens but only updates the reserves by decreasing it by the fees of these amounts. unchecked // @audit decreases by fees only, not by amount0/amount1 reserve0 -= uint128amount0fees; reserve...

burn do not burn reserve

Handle broccoli Vulnerability details burn do not burn reserve Impact ConcentratedLiquidityPool.solL263-L266 The dev mistakenly write: reserve0 -= uint128amount0fees; reserve1 -= uint128amount1fees; It should be reserve0 -= uint128amount0fees; reserve1 -= uint128amount1fees; Other users can't min...

HybridPool's reserve is converted to "amount" twice

Handle cmichel Vulnerability details The HybridPool's reserves are stored as Bento "amounts" not Bento shares in updateReserves because balance converts the current share balance to amount balances. However, when retrieving the reserve0/1 storage fields in getReserves, they are converted to amoun...

ConstantProductPool.burnSingle swap amount computations should use balance

Handle cmichel Vulnerability details The ConstantProductPool.burnSingle function is basically a burn followed by a swap and must therefore act the same way as calling these two functions sequentially. The token amounts to redeem amount0, amount1 are computed on the balance not the reserve. Howeve...

Unsafe cast in IndexPool mint leads to attack

Handle cmichel Vulnerability details The IndexPool.mint function performs an unsafe cast of ratio to the uint120 type: uint120 ratio = uint120divtoMint, totalSupply; Note that toMint is chosen by the caller and when choosing toMint = 2120 totalSupply / BASE, the ratio variable will be 2120 and th...

IndexPool.mint The first liquidity provider is forced to supply assets in the same amount, which may cause a significant amount of fund loss

Handle WatchPug Vulnerability details When reserve == 0, amountIn for all the tokens will be set to the same amount: ratio, regardless of the weights, decimals and market prices of the assets. The first liquidity provider may not be aware of this so that it may create an arbitrage opportunity for...

GHSA-X7VR-C387-8W57 Integer Overflow/Infinite Loop in the http crate

HeaderMap::reserve used usize::nextpoweroftwo to calculate the increased capacity. However, nextpoweroftwo silently overflows to 0 if given a sufficiently large number in release mode. If the map was not empty when the overflow happens, the library will invoke self.grow0 and start infinite probin...

GHSA-MH6H-F25P-98F8 Uncontrolled memory consumption in protobuf

Affected versions of this crate called Vec::reserve on user-supplied input. This allows an attacker to cause an Out of Memory condition while calling the vulnerable method on untrusted data...

GHSA-27J5-4P9V-PP67 `std::abort` raised from `TensorListReserve`

Impact Providing a negative element to numelements list argument of tf.rawops.TensorListReserve causes the runtime to abort the process due to reallocating a std::vector to have a negative number of elements: python import tensorflow as tf tf.rawops.TensorListReserve elementshape = tf.constant1,...