-
Causes CVE-2022-34718, does it happen in this case? (15th Sep 2022)
Preface: Whether it is correct or not, this is a spirit for learning. Background: The critical CVE (CVE-2022-34718 ) impacts Windows TCP/IP, allowing an unauthenticated attacker to send a specially crafted IPv6 packet to Windows node where IPSec is enabled. But the supplier didn’t reveal too many details. My observation: CVE-2021-24074 and CVE-2021-24094 occurred in…
-
CVE-2022-35836 – Microsoft OLE DB Provider for SQL Server Remote Code Execution Vulnerability (13th Sep 2022)
Preface: Failures happen all the time, it’s important to see how to deal with them. Background: Background: The new OLE DB provider is called the Microsoft OLE DB Driver for SQL Server (MSOLEDBSQL). The Microsoft OLE DB Provider for SQL Server (SQLOLEDB) still ships as part of Windows Data Access Components. It isn’t maintained anymore…
-
Take a closer look at CVE-2022-40307 – a design flaw in capsule-loader[.]c in Linux (13th Sep 2022)
Preface: Not sure if this vulnerability affects all linux brands. However, Debian has solved this problem. Maybe when you turned on your linux yesterday. A critical update will cover this issue.Remark: Debian Linux’s mainline kernel has been ported bare-metal to the Apple M1 SoC, opening up the way for a Linux ecosystem replacing MacOS. Background:…
-
Closer look – CVE-2022-39188 : LINUX KERNEL UP TO 5.18 GPU DEVICE DRIVER TLB[.]H UNMAP_MAPPING_RANGE RACE CONDITION (9th Sep 2022)
Preface: Race conditions are most commonly associated with computer science and programming. They occur when two computer program processes, or threads, attempt to access the same resource at the same time and cause problems in the system. Race conditions are considered a common issue for multithreaded applications. Background: The kernel uses virtual memory areas to…
-
CVE-2022-39189 – Linux Kernel up to 5.18.16 x86 KVM Subsystem Privilege Escalation (8th Sep 2022)
Preface: Don’t contempt this design weakness. Why? Red Hat Virtualization (RHV, previously known as Red Hat Enterprise Virtualization) is an enterprise virtualization product based on the KVM hypervisor. Background: Avi Kivity began the development of KVM in mid-2006 at Qumranet, a technology startup company that was acquired by Red Hat in 2008. KVM surfaced in…
-
CVE-2022-3075 – Insufficient data validation in the Mojo vulnerability. How can attackers exploit it? (8th Sep 2022)
Preface: What is the Slice() method in JavaScript? In any programming language, arrays play an important role in storing data and managing different types of data. Developers often need to filter out the array, merge multiple arrays, and push or pop elements from an array to fulfill the required tasks.The slice() method is used to…
-
About CVE-2022-39842 – PXA3xx graphics controller drivers design weakness (5th Aug 2022)
Preface: The slogan in past stated that Linux is secure because vulnerability not often happen compare to Microsoft Windows OS. Perhaps the dream was broken. Linux like a free of charge Lego toys.Since there are plenty of opensource driver and library around. As a result, it is hard to avoid the vulnerability happen.Sometimes, when vulnerability…
-
CVE-2022-22059 – Take a closer look at Snapdragon vulnerability products (4th Sep 2022)
Preface: Qualcomm has been a major player in the technology space, especially since the company saw the potential of IoT and mobile processing early on, so it’s been growing. Background: Qualcomm enables programming of the Adreno GPU in its Snapdragon application processors via the open standard OpenCL language and API. OpenCL support enables programmers to…
-
CVE-2022-1841: Design flaw in some versions of Zephyr transport layer (1st Sep 2022)
Preface: What is difference between underflow and overflow?Buffer Overflow – When accessed memory is beyond the end of the buffer.Buffer Underflow – When the accessed memory is before the beginning of a buffer. Background: Zephyr is embedded RTOS, it compatible to support more than 350 CPU boards includes x86, ARM, ARC, MIPS, etc. The Zephyr…
-
Quick overview: Microsoft Azure Partial Service Disruption incident on 31st Aug 2022.
Preface: Microsoft officials said a bug in Ubuntu 18/04 “will lead to DNS resolution errors”, and that “reports of this issue are confined to this single Ubuntu version.” 31st Aug 2022 Background: How to install Kubernetes on Ubuntu 18.04 Bionic Beaver Linux? Install docker on every node (master and slave nodes). Execute the below linux…