-
CVE-2022-3642 – Insecure Default Variable Initialization on IoT USB adapter (21st Oct 2022)
Preface: In some languages such as C and C++, stack variables are not initialized by default. They generally contain junk data with the contents of stack memory before the function was invoked. An attacker can sometimes control or read these contents. Background: Wireless routers have fourteen different channels they can use for 2.4 GHz Wi-Fi,…
-
CVE-2022-3621 NILFS inode[.]c null design weakness (20th Oct 2022)
Preface: NILFS merged into Linux as the first File System from Japan in June 2009. This job completed by NTT Cyber Space Laboratories.NILFS is a file system for Linux that saves a snapshot, a historical view of the file system, automatically and continuously. This feature enables the system not only to quickly recover from system…
-
New faces replace traditional attack tools (Oct 20, 2022)
Preface: In IoT and IIoT world, windows OS and Linux Based OS become the mainstream technology. The endpoint devices mainly based on Linux operation system as a design baseline. If you have chances to explore the operation system architecture for IIoT and IoT. Your will found that it is a Linux world. Even through the…
-
CVE-2022-31813 :Hop-by-hop definition of RFC2616 (13.5.1) as a vulnerability in Oracle Secure Backup (18th Oct 2022)
Preface: The X-Forwarded-For request header is automatically added and helps you identify the IP address of a client when you use an HTTP or HTTPS load balancer. Because load balancers intercept traffic between clients and servers, your server access logs contain only the IP address of the load balancer. To see the IP address of…
-
CVE-2022-3541 has impact on IoT Linux chips and should be upgraded with firmware (17th Oct 2022)
Preface: BPF introduced two big innovations in packet filtering: A new virtual machine (VM) designed to work efficiently with register-based CPUs. The usage of per-application buffers that could filter packets without copying all the packet information. This minimized the amount of data BPF required to make decisions. Background: BPF programs are designed to run in…
-
Security Focus – CVE-2022-3524 Ping6 command (16th Oct 2022)
Preface: Ping6 command uses ICMPv6 ECHO_REQUEST to check network connectivity. This design weakness found July 2022 (few months ago). The remedy looks simple, the key element is destroy the ping6 socket – inet6_destroy_sock(sk); Background: In computing, a system call (commonly abbreviated to syscall) is the programmatic way in which a computer program requests a service…
-
CVE-2022-20436 – Android design weakness.There is an unauthorized service in the system service. (11th Oct 2022)
Preface: Looking back at the history of Android, explore Android’s ongoing evolution with this visual timeline of versions, starting Cupcake (early 2009’s Android 1.5 Cupcake) and going all the way to 2022’s Android 13 release. It really was a revolution from cordless phones to smart devices. Background: What is the role of an Activitymanager in…
-
Security Focus: CVE-2022-42012 – Design flaw in the Dbus daemon (10/10/2022)
Preface: D-bus has nothing to do with the kernel or the driver, but no one is preventing drivers from having a D-Bus service too, if that’s their design. There are two standard message bus instances: the systemwide message bus (installed on many systems as the “messagebus” init service) and the per-user-login-session message bus (started each…
-
CVE-2022-42703 – mm/rmap[.]c in the Linux kernel before 5[.]19[.]7 has a use-after-free related to leaf anon_vma double reuse. (9th Oct 2022)
Preface: Memory is managed differently depending on the programming language in which the application is written. Some languages, such as C, require the programmer to manage direct allocation of memory. Background: There is usually a requirement in the kernel to find all VMAs that map this page through the struct page data structure. Early linux…
-
CVE-2022-39280 – ReDoS issue in dparse (6th Oct 2022)
Preface: Python can be used to develop a wide variety of applications, including web applications, gaming applications, enterprise applications, ML applications, image processing, text processing, and more. Background: When managing Python environments, one of the key concerns is dependency management. Dependencies are all of the software components required by your project in order for it…