All posts by admin

CVE-2023-48105: Weakness in buffer boundary checks in wasm loader (23rd Nov 2023)

Preface: Decentralized AI is an approach to AI where the data and models are distributed across multiple devices, rather than being centralized in a single location. Such design benefits to AI infrastructure avoiding denial of service attack and let unknown technical matter occurs during this period.

Background: Internet Computing aims to extend the capabilities of the public Internet through a serverless cloud model. Serverless is a cloud computing application development and execution model that enables developers to build and run application code without provisioning or managing servers or backend infrastructure.

WebAssembly (wasm), is a virtual machine for executing general purpose code. When designing the architecture of the Internet Computer, the DFINITY Foundation recognized the potential of WebAssembly as a virtual machine for blockchain. Apart from Blockchain, Dfinity Foundation and Singularitynet Partner to Transform Decentralized AI with Blockchain Integration.

A canister is a WebAssembly (wasm) module that can run on the Internet Computer. Only four programming language currently have Canister Development Kits (CDK) — a suite of libraries and scripts for building WebAssembly binaries that are compatible with the Internet Computer. They are Motoko, Python, TypeScript, and Rust.

Note: As shown above, it shows the future sustainability of Python. There is no doubt that Python can be expanded into the world of artificial intelligence.

Vulnerability details: An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the wasm_loader_prepare_bytecode function in core/iwasm/interpreter/wasm_loader[.]c.

Additional: Internet Computing aims to extend the capabilities of the public Internet through a serverless cloud model. While the snapshot and rewinding technique with nested attestation can enable a fast and verifiable reset of an enclave, ensuring the security of such techniques is not trivial, particularly in a serverless environment where an adversary may try to breach the security by executing a malicious workload. To address this issue, it is proposed multi-layer intra-enclave compartmentalisation (MLIEC) using compiler techniques. With MLIEC, we can protect the snapshot and rewinding technique in a higher security layer than the regular enclave code (e.g., the Wasm runtime), ensuring that even if the regular enclave environment is compromised, the enclave reset can still be carried out correctly and restore the environment. However the design weakness occurs on buffer boundary checks in wasm loader. So, the remedy is adding more buffer boundary checks in wasm loader. Example: CHECK_BUF(p, p_end, 1);

Official announcement: Please refer to the link for details –

Do not contempt CVE-2023-6238: kernel: nvme: memory corruption via unprivileged user passthrough  (22nd Nov 2023)

Preface: High-performance computing is a method of processing large amounts of data and performing complex calculations at high speed. HPC is well suited for AI, which uses large data sets and complex models. HPC and AI combined have use cases in the following areas: Predictive Analytics. Physics and Modeling.

IO-Heavy HPC Computing: Requires systems that can read/write and store large amounts of data on disks. This type of computing includes systems that provide fast NVMe implementations for local IO or as part of a parallel file system.

Background: What is metadata for NVMe? Similar to SCSI / SAS devices, the NVMe standard supports the addition of 8 bytes (called metadata or protection information (PI)) to each data sector to ensure data integrity during data transfer.

NVMe protocol defines commands that utilize Physical Region Pages (PRP)/Scatter Gather Lists (SGL) to denote a data buffer location in host memory. The data buffer may be represented using single or multiple PRP/SGL entries similar to a linked list. Associated information for a command including PRP/SGL may be formed before the command is issued to the SSD for execution. The SSD, while executing the command, may fetch the associated PRP/SGL and perform data movement related to the command.

However, NVMe has no separate field to encode the metadata length expected (except when using SGLs). Because of that we can’t allow to transfer arbitrary metadata, as a metadata buffer that is shorted than what the device expects for the command will lead to arbitrary kernel (if bounce buffering) or userspace (if not) memory corruption.

Vulnerability details: A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. An unprivileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption.

Official announcement: Please refer to the link for details –

About CVE-2023-48223: Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. (20th Nov 2023)

Preface: How is JavaScript different from Java? · Java is an OOP programming language, and Javascript is an OOP description language.

Background: JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JWT is suitable for stateless scenarios and APIs, while server-side tokens work best for session-based authentication in web applications.

Vulnerability details: The fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, fast-jwt library does not properly prevent JWT algorithm confusion for all public key types.

The ‘publicKeyPemMatcher’ in ‘fast-jwt/src/crypto[.]js’ does not properly match all common PEM formats for public keys. To exploit this vulnerability, an attacker needs to craft a malicious JWT token containing the HS256 algorithm, signed with the public RSA key of the victim application.

Attack scenario: This attack will only work if the victim application utilizes a public key containing the `BEGIN RSA PUBLIC KEY` header. Applications using the RS256 algorithm, a public key with a `BEGIN RSA PUBLIC KEY` header, and calling the verify function without explicitly providing an algorithm, are vulnerable to this algorithm confusion attack which allows attackers to sign arbitrary payloads which will be accepted by the verifier.

Solution: Version 3.3.2 contains a patch for this issue.

Workaround: As a workaround, change line 29 of `blob/master/src/crypto[.]js` to include a regular expression.

Official announcement: Official details: Please refer to the link for details –

CVE-2023-20519 whether similar to CVE-2023-33250? (20th Nov 2023)

Preface: The term cloud native refers to the concept of building and running applications to take advantage of the distributed computing offered by the cloud delivery model. Cloud native involves cloud technologies like microservices, container orchestrators, and auto scaling. AMD 4th Gen EPYC CPU EPYC 97X4 processors, with up to 128 cores, deliver up to 3.7x throughput performance for key cloud native workloads.

Background: AMD EPYC™ 9004 Series Processors represent the fourth generation of AMD EPYC server-class processors. The 4th Gen AMD EPYC processors with AMD 3D V-Cache technology further extend the AMD EPYC 9004 Series of processors to deliver the world’s best x86 CPU for technical computing workloads such as computational fluid dynamics (CFD), finite element analysis (FEA), electronic design automation (EDA) and structural analysis.

Vulnerability details: AMD Processors could allow a local authenticated attacker to bypass security restrictions, caused by an use-after-free vulnerability in the management of an SNP guest context page. By sending a specially crafted request, an attacker could exploit this vulnerability to masquerade as the guest’s migration agent resulting in a potential loss of guest integrity.

Platforms Affected:
AMD 3rd Generation EPYC
AMD 4th Generation EPYC

Official announcement: Official details: Please refer to the link for details –

About PostgreSQL : CVE-2023-5869 (17th Nov 2023)

Preface: As a PostgreSQL database’s workload increases, the instance’s memory usage increases. Instances that consume lots of memory can create a performance bottleneck that can sometimes lead to out-of-memory issues. An integer overflow occurs when you attempt to store inside an integer variable a value that is larger than the maximum value the variable can hold. The C standard defines this situation as undefined behavior. Refer to posgreSQL manual, user-defined functions can be written in C (or a language that can be made compatible with C, such as C++).

Background: PostgreSQL is a powerful, open source object-relational database system. Besides, PostgreSQL is a relational database. It stores data points in rows, with columns as different data attributes. A table stores multiple related rows.

PostgreSQL memory components are broadly divided into two sections:

1.Global memory: this is shared across all processes to execute queries; for example, shared_buffers and max_connections.

2.Local memory: this is dedicated memory assigned to each connection; for example, work_mem, maintenance_work_mem, and temp_buffers.

Vulnerability details: While modifying certain SQL array values, missing overflow checks let authenticated database users write arbitrary bytes to a memory area that facilitates arbitrary code execution. Missing overflow checks also let authenticated database users read a wide area of server memory. The CVE-2021-32027 fix covered some attacks of this description, but it missed others.

About CVE-2021-32027: A flaw was found in postgresql. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Fixed In Version: PostgreSQL 16.1, PostgreSQL 15.5, PostgreSQL 14.10, PostgreSQL 13.13, PostgreSQL 12.17 and PostgreSQL 11.22

Official announcement: Official details: Please refer to the link for details –

The ins and outs of CVE-2023-23583 (16th Nov 2023)

Preface: The REP MOVSB/STOSB instruction can enhance fast strings attempts to move as much of the data with larger size load/stores as possible. So, a patch exposes ERMS feature to KVM guests in June 2011.

Background: REP is a prefix that makes the processor repeat the following instruction. It decrements the RCX register each time the following instruction is executed until RCX reaches zero. REP MOVSB assembles to just two bytes of machine code, ‘F3’ and ‘A4’ in hex, so it’s an incredibly concise way of doing a data copy.

When there is an overlap between the source and destination regions, software may need to use memmove instead of memcpy to ensure correctness. It is possible to use REP MOVSB in conjunction with the direction flag (DF) in a memmove() implementation to handle situations where the latter part of the source region overlaps with the beginning of the destination region. However, setting the DF to force REP MOVSB to copy bytes from high towards low addresses will experience significant performance degradation.

Ref: What is the purpose of the direction flag? This flag is used to determine the direction (‘forward’ or ‘backward’) in which several bytes of data will be copied from one place in the memory, to another. The direction is important mainly when the original data position in memory and the target data position overlap.

Vulnerability details: Under certain microarchitectural conditions, Intel has identified cases where execution of an instruction (REP MOVSB) encoded with a redundant REX prefix may result in unpredictable system behavior resulting in a system crash/hang, or, in some limited scenarios, may allow escalation of privilege from CPL3 to CPL0.

Remediation: Intel is providing a microcode update to mitigate this issue 

Official details: Please refer to the link for details –

Citrix Hypervisor Security Bulletin for CVE-2023-23583 and CVE-2023-46835 –

CVE-2023-34060: Whether it hit this design weakness? (14th Nov 2023)

Preface: Before you start reading. Perhaps below two different url will lure your interest of this article. Please read 1 first, then 2

1:vCenter Server Appliance Web Console (VAMI) is removed from vCenter Server 6.0  –

2:Change VCSA 6.7 SSH port –

Ref: The vCenter Server appliance is a preconfigured virtual machine that is optimized for running vCenter Server and the associated services. The vCenter Server appliance package contains the following software: Photon OS® 3.0. The vSphere authentication services. PostgreSQL.

Background: What is the difference between vCenter and vCloud director? A vCenter admin can see virtual data centers, which are logical units for management, a vCloud Director user (tenant) can see only organizational data centers, catalogs, users, and options to manage a virtual organizational data center.

Vulnerability details: VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older version. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.Known Attack Vectors On an upgraded version of VMware Cloud Director Appliance 10.5, a malicious actor with network access to the appliance can bypass login restrictions when authenticating on port 22 (ssh) or port 5480 (appliance management console). This bypass is not present on port 443 (VCD provider and tenant login). On a new installation of VMware Cloud Director Appliance 10.5, the bypass is not present.

Official announcement: Please refer to the link for details –

CVE-2023-47346: A vulnerability encountered  on a 5G freeware. But do not contempt these technical factors. Perhaps it also encounter in other similar technology vendors.(14th Nov 2023)

Preface: The technology trend driven transformation in mobile communication world in global. Not only will mobile devices require more RAM to handle 5G-enabled multimedia applications and tasks, As a result, enhancing memory is key to unlocking the 5G future!

Background: The free5GC is an open-source project for 5th generation (5G) mobile core networks. The ultimate goal of this project is to implement the 5G core network (5GC) defined in 3GPP Release 15 (R15) and beyond.

What is 3GPP standard release 15? 3GPP Rel. 15 will update the MC service requirements of the railway and maritime industries. Low-power machine connectivity across trains, ships, and other automobiles will improve, leaving less room for error in critical transmissions and navigation pathway sharing.

Vulnerability details: Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages.

Official announcement: Please refer to the link for details –

The vendor did not provide details of CVE-2023-22107. Will similar vulnerabilities occur in the following scenarios? (13th Nov 2023)

Preface: When we see new vulnerability information posted on forums or NVD. According to market practice, suppliers have provided patches to customers in advance. Maybe they already received the patch earlier (few weeks ago). But a lot of vulnerability items not intend to disclose the details. Perhaps this is the way. It will reduce the attack ratio. But for the people who have interest to know. For sure it will increase the time to conduct the analytic. We believe Artificial Intelligence is powerful. But if it do not have related information.  AI also cannot provide a precise the answer.

Background: Oracle EBS applications are delivered from servers, databases, storage, and applications hosted in your local network, on-premises. Why use Oracle EBS? Oracle EBS enables organizations to manage their procurement process, from purchasing to invoicing and payment. Supply chain management. Oracle EBS provides a complete solution for managing the supply chain, including inventory management, order management, and logistics. Human resources.

Vulnerability details: Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: UI Components). Supported versions that are affected are ECC: 8, 9 and 10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Enterprise Command Center Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Enterprise Command Center Framework, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Enterprise Command Center Framework accessible data as well as unauthorized read access to a subset of Oracle Enterprise Command Center Framework accessible data.

CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts).

CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Remark: The vendor did not provide details of CVE-2023-22107. Will similar vulnerabilities occurs in attached diagram scenarios?

Official announcement: Please refer to the link for details –

CVE-2023-46604: Apache ActiveMQ is vulnerable to Remote Code Execution (10th Nov 2023)

Preface: While ActiveMQ is a traditional message broker, Apache Kafka is a distributed streaming platform designed to handle high-velocity, high-volume, and fault-tolerant data streams. It was originally developed at LinkedIn and later donated to the Apache Software Foundation.

Background: ActiveMQ is open source, message-oriented middleware (MoM). It was written in Java with a full JMS (Java Message Service) client.  OpenWire is the native protocol that Apache ActiveMQ uses. Message brokers, like ActiveMQ, can filter and process individual events.

Vulnerability details: Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause the broker to instantiate any class on the classpath. 

Remedy: Users are recommended to upgrade to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3, which fixes this issue.

Official announcement: Please refer to the link for details –

Critical: Red Hat AMQ Broker 7.11.4 release and security update –

Critical: Red Hat AMQ Broker 7.10.5 release and security update –

Critical: security update jboss-amq-6/amq63-openshift container image –

Critical: jboss-amq-6-amq63-openshift-container security update –