GSD-2022-1003462 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.123 by commit...

GSD-2022-1003197 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.48 by commit...

GSD-2022-1002527 x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.5 by commit...

PT-2022-31926

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.199 Description The issue is related to Processor MMIO Stale Data. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v5.4.199, update to...

PT-2022-32194

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.284 Description The issue is related to Processor MMIO Stale Data. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.14.284, update to...

PT-2022-32078

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.19.248 Description The issue is related to Processor MMIO Stale Data. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.19.248, update to...

PT-2022-32289

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.319 Description The issue is related to Processor MMIO Stale Data. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions prior to v4.9.319, update to...

PT-2022-37863

x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.18.5 by commit...

PT-2022-31725

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.123 Description The issue is related to Processor MMIO Stale Data, with a mitigation added to address potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven...

HPESBHF04322 rev.1 - Certain HPE ProLiant DX Servers Using Certain Intel Processors, INTEL-SA-00615, 2022.1 IPU – Intel Processors MMIO Stale Data Advisory, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DX170r Gen10 server - Prior to 2.6605172022 - Use BIOS family U38. HPE ProLiant DX190r Gen10 server - Prior to 2.6605172022 - Use BIOS family U38. HPE ProLiant...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.308.9 - x86/speculation/mmio: Fix late microcode loading Patrick Colp Orabug: 34276099 5.4.17-2136.308.8 - Add debugfs for controlling MMIO state data Kanth Ghatraju Orabug: 34202259 CVE-2022-21123 CVE-2022-21125 CVE-2022-21127 CVE-2022-21166 - KVM: x86/speculation: Disable Fill buffe...

HPESBHF04320 rev.2 - Certain HPE ProLiant BL/DL/ML/XL/MicroServer and Apollo Servers Using Certain Intel Processors, INTEL-SA-00615, 2022.1 IPU – Intel Processors MMIO Stale Data Advisory, Local Disclosure of Information

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4200 Gen10 Server - Prior to 2.6605172022 HPE ProLiant BL460c Gen10 Server Blade - Prior to 2.6606012022 HPE ProLiant DL20 Gen10 Server - Prior to 2.5804142022 HP...

CVE-2021-26400

AMD processors may speculatively re-order load instructions which can result in stale data being observed when multiple processors are operating on shared memory, resulting in potential data leakage...

Chainlink's latestRoundData might return stale or incorrect results

Lines of code Vulnerability details Impact Chainlink's latestRoundData is used but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation: Proof of Concept...

Unchecked oracle return value

Lines of code Vulnerability details Impact The return value bool success of oracle.get calls is ignored. This could lead to stale data or incorrect prices due to oracle issues. Proof of Concept NFTPairWithOracle.solL287 Change to bool success, uint256 rate = loanParams.oracle.getaddressthis,...

Chainlink's latestRoundData might return stale or incorrect results

Lines of code Vulnerability details , int basePrice, , , = baseAggregator.latestRoundData; On ChainlinkPriceOracle.sol, we are using latestRoundData, but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation:...

Potentially Incomplete or Stale Data from Oracle

Lines of code Vulnerability details Impact Calls to the Chainlink price oracle via refreshedAssetPerBaseInUQ in ChainlinkPriceOracle.sol use the correct function latestRoundData per Chainlink's documentation, but lacks the recommended validations to ensure that the round is complete and does not...

Chainlink oracle data can be stale

Lines of code Vulnerability details Impact Oracle data can be stale which can lead to wrong calculations for balancing indexes. Proof of Concept When lastRoundData is called only price is pulled from the provided data. RoundId should be checked to ensure the data is updated. Recommended Mitigatio...

Chainlink's latestRoundData might return stale or incorrect results

Lines of code Vulnerability details Impact In ChainlinkPriceOracle.sol, latestRoundData is used but there is no check if the return value indicates stale data. This could lead to stale prices according to the Chainlink documentation: Proof of Concept ChainlinkPriceOracle.solL83...

Chainlink oracle might return stale data

Lines of code Vulnerability details Impact Oracle might return stale data for basePrice and quotePrice. Proof of Concept refreshedAssetPerBaseInUQ in ChainlinkPriceOracle.sol does not check if the data from Chainlink is fresh . If there is a problem with the Chainlink oracle, this contract may be...