-
Alert industries using PCMCIA technology 31st Oct 2022
Preface: PCMCIA Cards have been around for many years and can still be found in today’s technology. These cards are now classed as legacy products, as they were first introduced over 25 years ago.PCMCIA cards come in 3 different types of memory; ATA, SRAM and Linear. The cards are still being made today to help…
-
A long run in CPython Design weakness, it is talking about seven years! 28th Oct 2022
Preface: The design weakness found on 2015. But till today, it looks the matter not been fixed. Perhaps you also read vendor statement. they will continue to update this advisory as additional information becomes available, said vendor. NetApp Advisory ID: NTAP-20220616-0001 Version: 4.0 Last updated: 09/26/2022 – https://security.netapp.com/advisory/ntap-20220616-0001/[SECURITY] Fedora 36 Update: 18 June 2022 –…
-
CVE-2022-43750: Linux Kernel usbmon module design weakness (26th Oct 2022)
Preface: Despite the presence of USB C ports, many smartphones launching in 2022 will feature USB 2.0. USB 2.0 is generally considered to have a signaling rate of 480 MB/s. Background: What is Usbmon in Linux? The name “usbmon” in lowercase refers to a facility in kernel which is used to collect traces of I/O…
-
CVE-2022-38181 Mali GPU Kernel Driver allows improper GPU memory processing operations (25th Oct 2022)
Preface: The GPU can not only receive transactions, but it can also initiate transactions. Which also means it has access to DRAM memory too.How can the GPU communicate to the CPU? Well, both have access to DRAM memory. The CPU can store information in DRAM memory (0x8000_0000 – 0x0000_0000) and then write to a register…
-
CVE-2022-41986 Extended question of One-time-password to similar. How secure you were? (24th Oct 2022)
Preface: One time password is secure. What If we following their algorithm generate a password and apply in both end. If it is matches with each other. Can we do the exploit? Perhaps the answer is “Yes”. The key technology is you understand how to use the “Time” value. Background: The IIJ SmartKey app produces…
-
CVE-2022-3642 – Insecure Default Variable Initialization on IoT USB adapter (21st Oct 2022)
Preface: In some languages such as C and C++, stack variables are not initialized by default. They generally contain junk data with the contents of stack memory before the function was invoked. An attacker can sometimes control or read these contents. Background: Wireless routers have fourteen different channels they can use for 2.4 GHz Wi-Fi,…
-
CVE-2022-3621 NILFS inode[.]c null design weakness (20th Oct 2022)
Preface: NILFS merged into Linux as the first File System from Japan in June 2009. This job completed by NTT Cyber Space Laboratories.NILFS is a file system for Linux that saves a snapshot, a historical view of the file system, automatically and continuously. This feature enables the system not only to quickly recover from system…
-
New faces replace traditional attack tools (Oct 20, 2022)
Preface: In IoT and IIoT world, windows OS and Linux Based OS become the mainstream technology. The endpoint devices mainly based on Linux operation system as a design baseline. If you have chances to explore the operation system architecture for IIoT and IoT. Your will found that it is a Linux world. Even through the…
-
CVE-2022-31813 :Hop-by-hop definition of RFC2616 (13.5.1) as a vulnerability in Oracle Secure Backup (18th Oct 2022)
Preface: The X-Forwarded-For request header is automatically added and helps you identify the IP address of a client when you use an HTTP or HTTPS load balancer. Because load balancers intercept traffic between clients and servers, your server access logs contain only the IP address of the load balancer. To see the IP address of…
-
CVE-2022-3541 has impact on IoT Linux chips and should be upgraded with firmware (17th Oct 2022)
Preface: BPF introduced two big innovations in packet filtering: A new virtual machine (VM) designed to work efficiently with register-based CPUs. The usage of per-application buffers that could filter packets without copying all the packet information. This minimized the amount of data BPF required to make decisions. Background: BPF programs are designed to run in…