-
CVE-2022-43945 Buffer overflow on NFSD (7th Nov 2022)
Preface: Is cloud computing in demand in 2022? Their latest forecast predicts the spending on public cloud services to jump from $257.5 billion in 2020 to $304.9 billion in 2022 as cloud services play a central role in helping businesses recover from the onslaughts of the pandemic.The current version of NFS is also called NFS…
-
CVE-2022-42793 Code Signing Verification Checks on Apple-Related Operating Systems (3rd Nov 2022)
Preface: If the supplier does not provide details. It’s hard to avoid that it’s not the exact answer. Abuse code signing-key compromise-use of revoked or expired certificates-code errors-Systems compromise Background: If you’re developing apps for iOS, you need to sign your builds in order to send them to the App Store. However, iOS code signing…
-
CVE-2022-43995 – Potential heap overflow when passwords exceed 8 characters (2nd Nov 2022)
Preface: The heap is an area of dynamically-allocated memory that is managed automatically by the operating system or the memory manager library. Memory on the heap is allocated, deallocated, and resized regularly during program execution, and this can lead to a problem called fragmentation. Background: For instance, when you download a c++ compiler for your…
-
Are you interested in CVE-2022-42827? (2nd Nov 2022)
Preface: Few years ago, people know the following details:io_service_open_extended is one of several undocumented MIG functions to communicate with IOKit drivers from user mode. This approach provides an opportunity for an attacker to perform kernel exploitation. Code writing in C-like languages can accidentally affect memory safety. Background: Memory Tagging Extension (MTE) is designed to provide…
-
CVE-2022-44019 – Total js 4 design weakness (30th Oct 2022)
Preface: A microframework is a term used to refer to minimalistic web application frameworks. It is contrasted with full-stack frameworks. Typically, a microframework facilitates receiving an HTTP request, routing the HTTP request to the appropriate controller, dispatching the controller, and returning an HTTP response. Microframeworks are often specifically designed for building the APIs for another…
-
Alert industries using PCMCIA technology 31st Oct 2022
Preface: PCMCIA Cards have been around for many years and can still be found in today’s technology. These cards are now classed as legacy products, as they were first introduced over 25 years ago.PCMCIA cards come in 3 different types of memory; ATA, SRAM and Linear. The cards are still being made today to help…
-
A long run in CPython Design weakness, it is talking about seven years! 28th Oct 2022
Preface: The design weakness found on 2015. But till today, it looks the matter not been fixed. Perhaps you also read vendor statement. they will continue to update this advisory as additional information becomes available, said vendor. NetApp Advisory ID: NTAP-20220616-0001 Version: 4.0 Last updated: 09/26/2022 – https://security.netapp.com/advisory/ntap-20220616-0001/[SECURITY] Fedora 36 Update: 18 June 2022 –…
-
CVE-2022-43750: Linux Kernel usbmon module design weakness (26th Oct 2022)
Preface: Despite the presence of USB C ports, many smartphones launching in 2022 will feature USB 2.0. USB 2.0 is generally considered to have a signaling rate of 480 MB/s. Background: What is Usbmon in Linux? The name “usbmon” in lowercase refers to a facility in kernel which is used to collect traces of I/O…
-
CVE-2022-38181 Mali GPU Kernel Driver allows improper GPU memory processing operations (25th Oct 2022)
Preface: The GPU can not only receive transactions, but it can also initiate transactions. Which also means it has access to DRAM memory too.How can the GPU communicate to the CPU? Well, both have access to DRAM memory. The CPU can store information in DRAM memory (0x8000_0000 – 0x0000_0000) and then write to a register…
-
CVE-2022-41986 Extended question of One-time-password to similar. How secure you were? (24th Oct 2022)
Preface: One time password is secure. What If we following their algorithm generate a password and apply in both end. If it is matches with each other. Can we do the exploit? Perhaps the answer is “Yes”. The key technology is you understand how to use the “Time” value. Background: The IIJ SmartKey app produces…