Summit, launched in 2018, delivers 8 times the computational performance of Titan’s 18,688 nodes, using only 4,608 nodes. Summit still carry the flags tell the world that he keep the fast run record.

Over the past decade, Linux Clusters founded and starting the competition with mainframe computer. The most famous IBM crossbar switch encounter doubt to technical world. Does he better than Linux Clusters? Crossbar – The processors are connected with non-internally blocking crossbar switch and communicate with each other via global interleaved memory.

The record shown on the diagram, even though the supercomputer CPU core increase 4 times compare to submit. But it do not have significant growth. Perhaps you may feeling that the bottleneck given from CPU. My personal comment is that crossbar coexists CPU and I/O direct way. Linux cluster form virtual matrix hoop up. But the design limitation is the server hardware instead of CPU. We keep our eye open to see who is the winner on next round? A crossbar switch, as part of a crossbar topology, channels data or signals between two different points in a network.

Remark: The crossbar setup is a matrix where each crossbar switch runs between two points, in a design that is intended to hook up each part of an architecture to every other part.

Preface: If you are not yet ready to share your project on GitHub. You can host your own Private GitHub. It is Gogs.

Product background: The goal of Gogs is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service. So all the design concept, program code and perhaps intellectual properties all keep in this place. Since the intension is not go for public and therefore it will be installed on private cloud or a single machine.

Vulnerability details: A design defect found in source code file (routes/api/v1/api.go). The impact causes affected software does not properly perform permission checks for routes.
Since there is no preventive control and therefore an attacker could exploit this vulnerability to perform unauthorized actions on a targeted system. Should you have interested of this issue, see top right hand side of the diagram. You will find part of the enhancement features. Perhaps you will speculate what is the actual problem.

Remedy – See url https://github.com/gogs/gogs/blob/master/routes/api/v1/api.go

Preface: GS register is used to differentiate between usermode and kernel mode range of address, after adding the relevant logical address component. The instruction swapgs is used to swap the GS register with the MSR values, and only in privileged mode this can be done.

Vulnerability details: CVE-2019-1125 was made public today or also referred to as the “SWAPGS” vulnerability as a new variant of Spectre V1 affecting Intel and AMD chips under Windows and Linux operation system. The SWAPGS vulnerability allows attackers to gain read access to privileged memory and builds off existing Spectre fixes. But AMD confirmed that its products are not vulnerable to this attack. Red Hat said it needs to update the Linux kernel to prevent SWAPGS vulnerabilities from affecting Intel and AMD chips.

Microsoft official announcement: https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1125

Red Hat official announcement: https://access.redhat.com/articles/4329821

What is Jackson Databind used for? Data Binding API is used to convert JSON to and from POJO (Plain Old Java Object) using property accessor or using annotations. It is of two type. Simple Data Binding – Converts JSON to and from Java Maps, Lists, Strings, Numbers, Booleans and null objects.

What is Ehcache? Ehcache is an open source, standards-based cache that boosts performance, offloads your database, and simplifies scalability.

Vulnerability details: A vulnerability in the FasterXML jackson-databind library could allow an unauthenticated remote attacker to execute arbitrary code on the target system. This defect exists because the SubTypeValidator.java source code file of the affected software incorrectly handles the default type when using Ehcache. An attacker could exploit this vulnerability by sending a request to submit a malicious input to the target system to execute arbitrary code.

Remedy: Update to jackson-databind release 2.9.9.2

Preface: Are GPU vulnerable to hacker attacks?

Background: On virtual machines running VMware Fusion provides support for OpenGL 2.1 to support 3D accelerated desktops. It is not enabled by default on ESXi and is enabled by default on Workstation and Fusion.

Vulnerability details:

CVE-2019-5521 – may lead to information disclosure or may allow attackers with normal user privileges to create a denial-of-service condition on the host.

CVE-2019-5684 – This vulnerability can be exploited only if the host has an affected NVIDIA graphics driver. Successful exploitation of this issue may lead to code execution on the host.

Security Focus: Since no additional details provided by vendor. But believe that the possible way let hacker exploit CVE-2019-5521 design weakness is Perfect Timing Attacks (Please refer to photo). Apart from that the hacker can exploit out of bound read / write to bypass address space layout randomization (ASLR). So, be alerted!

Vendor announcement: please refer to the url – https://www.vmware.com/security/advisories/VMSA-2019-0012.html