-
Take a closer look at CVE-2022-40307 – a design flaw in capsule-loader[.]c in Linux (13th Sep 2022)
Preface: Not sure if this vulnerability affects all linux brands. However, Debian has solved this problem. Maybe when you turned on your linux yesterday. A critical update will cover this issue.Remark: Debian Linux’s mainline kernel has been ported bare-metal to the Apple M1 SoC, opening up the way for a Linux ecosystem replacing MacOS. Background:…
-
Closer look – CVE-2022-39188 : LINUX KERNEL UP TO 5.18 GPU DEVICE DRIVER TLB[.]H UNMAP_MAPPING_RANGE RACE CONDITION (9th Sep 2022)
Preface: Race conditions are most commonly associated with computer science and programming. They occur when two computer program processes, or threads, attempt to access the same resource at the same time and cause problems in the system. Race conditions are considered a common issue for multithreaded applications. Background: The kernel uses virtual memory areas to…
-
CVE-2022-39189 – Linux Kernel up to 5.18.16 x86 KVM Subsystem Privilege Escalation (8th Sep 2022)
Preface: Don’t contempt this design weakness. Why? Red Hat Virtualization (RHV, previously known as Red Hat Enterprise Virtualization) is an enterprise virtualization product based on the KVM hypervisor. Background: Avi Kivity began the development of KVM in mid-2006 at Qumranet, a technology startup company that was acquired by Red Hat in 2008. KVM surfaced in…
-
CVE-2022-3075 – Insufficient data validation in the Mojo vulnerability. How can attackers exploit it? (8th Sep 2022)
Preface: What is the Slice() method in JavaScript? In any programming language, arrays play an important role in storing data and managing different types of data. Developers often need to filter out the array, merge multiple arrays, and push or pop elements from an array to fulfill the required tasks.The slice() method is used to…
-
About CVE-2022-39842 – PXA3xx graphics controller drivers design weakness (5th Aug 2022)
Preface: The slogan in past stated that Linux is secure because vulnerability not often happen compare to Microsoft Windows OS. Perhaps the dream was broken. Linux like a free of charge Lego toys.Since there are plenty of opensource driver and library around. As a result, it is hard to avoid the vulnerability happen.Sometimes, when vulnerability…
-
CVE-2022-22059 – Take a closer look at Snapdragon vulnerability products (4th Sep 2022)
Preface: Qualcomm has been a major player in the technology space, especially since the company saw the potential of IoT and mobile processing early on, so it’s been growing. Background: Qualcomm enables programming of the Adreno GPU in its Snapdragon application processors via the open standard OpenCL language and API. OpenCL support enables programmers to…
-
CVE-2022-1841: Design flaw in some versions of Zephyr transport layer (1st Sep 2022)
Preface: What is difference between underflow and overflow?Buffer Overflow – When accessed memory is beyond the end of the buffer.Buffer Underflow – When the accessed memory is before the beginning of a buffer. Background: Zephyr is embedded RTOS, it compatible to support more than 350 CPU boards includes x86, ARM, ARC, MIPS, etc. The Zephyr…
-
Quick overview: Microsoft Azure Partial Service Disruption incident on 31st Aug 2022.
Preface: Microsoft officials said a bug in Ubuntu 18/04 “will lead to DNS resolution errors”, and that “reports of this issue are confined to this single Ubuntu version.” 31st Aug 2022 Background: How to install Kubernetes on Ubuntu 18.04 Bionic Beaver Linux? Install docker on every node (master and slave nodes). Execute the below linux…
-
CVE-2022-21385 – Some vulnerabilities are not being exploit or there is no available exploit. But it is good to know. 29th Aug 2022
Preface: The vendor who transforming Linux kernel not limit to Apple computer. Oracle, they are also has it own Linux Kernel so called UEK (Unbreakable Enterprise Kernel).So, who maintains software updates for Oracle Linux? It will depend on Oracle Linux yum server. Background: Oracle Linux commes with a choice of two kernels, the UEK, which…
-
CVE-2022-1043 A flaw was found in the Linux kernel’s io_uring implementation (29th Aug 2022)
Preface: The identification of this vulnerability is CVE-2022-1043 since 03/22/2022. On 21st Aug 2022 the problem was fixed (see below):io_uring: fix xa_alloc_cycle() error return value checkWe currently check for ret != 0 to indicate error, but ‘1’ is a valid return and just indicates that the allocation succeeded with a wrap. Correct the check to…