All posts by admin

Potential Risk of CVE

About INTEL-SA-01393: Do not contempt in the medium-risk UEFI design weakness.(20th Mar 2026)

Leave a comment

Preface: Intel Xeon W processor UEFI settings differ from consumer Intel Core CPUs, primarily to support enterprise-grade features. Xeon W UEFI (BIOS) includes specialized configurations for ECC RAM management, enhanced virtualization, advanced PCIe lane configuration, and platform-specific stability settings not required for standard desktop systems.

Background: Linux tools can modify fundamental UEFI settings, including variables, boot order, and Secure Boot keys (PK, KEK, db, dbx) using tools like efibootmgr, efitools, and direct /sys/firmware/efi/efivars access. Advanced tools can even modify flash images, though direct firmware flashing is generally manufacturer-dependent.

Strengthening length validation in efivarfs

– before performing memory comparisons to prevent OOB (Out-of-Bounds) access.

Strict Length Match:

Ensure the length of the string to be compared (len)

matches the expected length (name->len) exactly.

Vulnerability details: A potential security vulnerability in UEFI for some Intel Reference Platforms may allow escalation of privilege. Intel is releasing firmware updates to mitigate these potential vulnerability.

CVE-2025-20096: Improper input validation in the UEFI firmware for some Intel Reference Platforms may allow an escalation of privilege. System software adversary with a privileged user combined with a high complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (none), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (high) and availability (high) impacts.

Official announcement: Please refer to the link for details – https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01393.html

Potential Risk of CVE

CVE-2026-4295: Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms (19th Mar 2026)

Leave a comment

Preface: AWS launched Kiro to make it the default entry point for cloud development. When developers open Kiro, it is already pre-configured with deep connections to AWS services (such as Lambda, S3, and Bedrock), making “cloud-native development” an out-of-the-box experience. Since Kiro includes an LLM, Kiro is involved in whatever the developer does. The advantage is that any incorrectly programmed code, Kiro will advise. On the other hand, all programmer thinking will also be learned by Kiro!

Background: Visual studio code capable multi-root workspace over a folder. VS Code that allows you to configure multiple distinct folders to be part of the same workspace. Instead of opening a folder as workspace, you open a <name>[.]code-workspace JSON file that lists all folders of the workspace. In Kiro-IDE, if a user clicks “Trust this Workspace” for the [.]code-workspace file, the IDE may incorrectly extend that trust to all folders listed in the JSON. A threat actor can include a folder they control—containing a malicious [.]kiro/scripts[.]json or [.]vscode/settings[.]json—which then executes with the user’s full permissions because the parent workspace was marked as “trusted.”

Vulnerability details: Improper trust boundary enforcement in Kiro IDE before version 0.8.0 on all supported platforms might allow a remote unauthenticated threat actor to execute arbitrary code via maliciously crafted project directory files that bypass workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 0.8.0 or higher.

Official announcement: Please refer to the link for more details –

https://nvd.nist.gov/vuln/detail/CVE-2026-4295

Potential Risk of CVE, Under our observation

AMD ID: AMD-SB-7050: About Vector Value Injection in AMD CPUs, AMD believes that existing mitigation guidance for FPVI remains valid and covers VVI cases as well. What are your thoughts on this? (18th Mar 2026)

Leave a comment

Background: The researchers’ paper introduces Vector Value Injection (VVI), which could allow an attacker with a deep understanding of microarchitectural behavior to inject values into vector registers during transient execution. Although they noted similarities with Floating Point Value Injection (FPVI), they reported Vector Value Injection as a new issue due to its capability to be triggered without denormal values as inputs.

AMD believes that VVI falls within the existing scope of CVE-2021-26314 (FPVI) as existing descriptions of FPVI do not specifically require denormal inputs. Additionally, AMD believes that existing mitigation guidance for FPVI remains valid and covers VVI cases as well.

Ref: CVE-2021-26314 – Potential floating point value injection in all supported CPU products, in conjunction with software vulnerabilities relating to speculative execution with incorrect floating point results, may cause the use of incorrect data from FPVI and may result in data leakage.

Official announcement: AMD ID: AMD-SB-7050 “Vector Value Injection in AMD CPUs”. Please refer to the link for details – https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7050.html

CVE-2021-26314 is a vulnerability from five years ago; however, in today’s parallel environment, the situation may be different!

How does Parallel Processing handle “Different Types”?

When tasks are different (e.g., one calculates Pi, one downloads a file, one reads a database), the system handles them in three ways:

1.         Heterogeneous Task Assignment (Asynchronous):

Instead of using a “map” (which does the same thing to many items), we use apply_async. This allows Core 1 to run a “Math” function while Core 2 runs a “Data Backup” function simultaneously.

2.         OS Scheduling & Context Switching:

The Operating System (OS) is the “manager.” If Task A is waiting for a slow Hard Drive (I/O Bound), the OS immediately moves Task B (CPU Bound) onto that core so no time is wasted.

3.         Hardware Resource Partitioning:

On a chip like the 9995WX, different execution units inside the core can work at once. One part of the core handles Integer math, while another handles Floating Point (AVX-512). This allows the processor to crunch different types of data within the same clock cycle

Vector Value Injection integrated to pool.apply_async (which runs different functions simultaneously) cannot be curcumvented through Register Scrubbing or Control-Flow Enforcement (CET). In fact, manually assigning different functions using `apply_async’ lowers the defense level potentially.

Why apply_async May Lower the Defense Level?

When you use pool.apply_async to launch different functions, Python’s multiprocessing creates multiple independent OS Processes.

•          Expanded Attack Surface: Compared to a single-process loop, a multi-process environment increases the frequency of Inter-Process Communication (IPC). If an attacker leverages Vector Value Injection, they can hunt for vulnerabilities in the different logic paths of each unique function.

•          Context Switching Risks: Frequent task scheduling can increase the risk of Cache Side-channel leaks. These leaks can sometimes bypass Register Scrubbing protection by capturing data before it is cleared.

End of article

Potential Risk of CVE

CVE-2026-0032 and CVE-2026-0038: Design weakness in Qualcomm SCM (Secure Channel Manager) and Qualcomm SCM/pKVM (Protected KVM). 17th Mar 2026

Leave a comment

Preface: CVE-2026-0032 and CVE-2026-0038 are very similar in terms of their root cause, impact, and remedies, as they both originate from a logical error in the Android kernel memory protection subsystem.

Background: In the Android Virtualization Framework (AVF), all guest operating systems (like the main Android OS and Microdroid) run at EL1, while the actual hypervisor (pKVM) runs at EL2. In Android downstream kernels (especially those for Qualcomm or MediaTek SoCs), the log details containing 0x%llx (a 64-bit hexadecimal address) represent physical memory ranges being transitioned into an isolated state.

This isolation is a critical security layer used to protect high-value hardware components from the main Android OS.

Key Similarities – Both vulnerabilities reside in the mem_protect[.]c file, which is responsible for enforcing memory access boundaries and managing memory protection between different execution environments (like the kernel and the Secure World).

The “similar” nature of these design weakness lies in how the qcom_scm_assign_mem logic was implemented. In both cases, the system failed to properly validate or constrain memory assignment requests, allowing a local attacker to bypass security restrictions.

Vulnerability details:

CVE-2026-0032 In multiple functions of mem_protect[.]c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Primary Driver – Qualcomm SCM (Secure Channel Manager)

CVE-2026-0038In multiple functions of mem_protect[.]c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Primary Driver – Qualcomm SCM / pKVM (Protected KVM)

Official announcement: Please refer to the link for details –  

CVE-2026-0038 – https://nvd.nist.gov/vuln/detail/CVE-2026-0038 CVE-2026-0032 – https://nvd.nist.gov/vuln/detail/CVE-2026-0032

Potential Risk of CVE

When I read the article titled “FortiGate Edge Intrusions Lead to Deep Network Compromise, Rogue Workstations” on technadu.com, I was very curious to know if it was true. (16th Mar 2026)

Leave a comment

Preface: Quoting the second paragraph of the article: Because FortiOS uses reversible encryption ….

Please see the link for article details – https://www.technadu.com/fortigate-edge-intrusions-lead-to-deep-network-compromise-rogue-workstations/623060/

Using reversible encryption in a firewall—or any security system designed to protect credentials—is considered a major security risk because it essentially stores passwords in a format equivalent to plaintext. Reversible encryption allows the encrypted data to be decrypted back into its original form, meaning if an attacker compromises the system, they can obtain the original credentials, rather than just a non-reversible hash.

Background: In Active Directory (AD), abusing the mS-DS-MachineAccountQuota attribute means that an attacker uses its default value (usually 10) to allow ordinary low-privilege users to create new computer accounts in the domain.

A technique known as Resource-Limited Delegation (RBCD) attack. This is the most common form of abuse. If an attacker has specific privileges (such as GenericWrite) on a target server, they can use ms-DS-MachineAccountQuota to create a fake computer account and set it to “act on behalf of others,” thereby impersonating a domain administrator to log in to the target server.

CVE-2025-59718 and CVE-2025-59719 are critical authentication bypass vulnerabilities (CVSS score 9.8) that stem from improper verification of cryptographic signatures (CWE-347) within Fortinet’s SAML implementation

Why these vulnerabilities exist?

Signature Skipping: An unauthenticated remote attacker can send a specially crafted SAML message that the Fortinet device accepts without properly checking it against the trusted Identity Provider (IdP) certificate.

Improper Validation Logic: Because the system fails to correctly validate the XML Digital Signature, it does not confirm if the message actually came from the legitimate IdP or if it was modified in transit.

Administrative Access: By crafting a SAML response that claims to be from a trusted issuer (like sso.forticloud.com) and asserting a privileged identity (like super_admin), attackers can gain full administrative control over the device without needing a valid password or certificate. 

Official announcement: Please see the link for article details:

CVE-2025-59718 – https://nvd.nist.gov/vuln/detail/CVE-2025-59718

CVE-2025-59719 – https://nvd.nist.gov/vuln/detail/CVE-2025-59719

Remedial action:

-Perform the patch operation as recommended by the supplier.

-Use Powershell, Query accounts that have permissions for a specific object.

Get-DomainObjectAcl -Identity “TargetUser” -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match “GenericWrite”}

-Disabling FortiCloud SSO immediately via the CLI (set admin-forticloud-sso-login disable) or GUI.

-Auditing logs for unauthorized administrative logins, particularly from unfamiliar IP addresses or at unusual times.

Cell Phone (iPhone, Android, windows mobile), Potential Risk of CVE

Explain the concept of design defect by combining CVE-2026-0006 and CVE-2026-21385 (12th Mar 2026)

Leave a comment

Preface: The Mainline module (com[.]android[.]media[.]swcodec) contains software-onlycodecs. AMD does not touch these; they are strictly managed and updated by Google via the Play Store to ensure universal playback and security across all devices. For performance (like 4K video or gaming), AMD must provide its own hardware-accelerated codecs in the “vendor” partition of the device. To work with the Mainline system, AMD (or partners like those working on Android-x86) must implement Codec 2.0 (C2) drivers. This is the standard “language” the Android media framework uses to talk to any GPU—whether it’s Qualcomm, ARM, or AMD.

Background: Cybercriminals may exploit two design flaws to achieve their goals. Details are as follows:

Step 1. Entry Point: Malicious Media File

The user receives or encounters a specially crafted media file (e.g., via a messaging app or a website). No user interaction beyond opening the file or its preview is required.

Step 2. Step 1: Remote Code Execution (CVE-2026-0006)

Component: com[.]android[.]media[.]swcodec (Media Codecs Mainline).

Action: A heap buffer overflow occurs during the decoding process.

Result: The attacker gains System-level remote code execution. However, they are still “sandboxed” within the media process.

Step 3. Step 2: The “Zero-Copy” Hand-off (DMA-BUF)

Component: Codec 2.0 (C2) Driver Bridge.

Action: To maintain performance, the system uses DMA-BUF Heaps to pass the malicious buffer directly to the GPU without copying it.

Vulnerability Point: The system assumes the buffer boundaries are safe because they were “validated” by the software layer.

Step 4. Step 3: Privilege Escalation (CVE-2026-21385)

Vulnerability details:

CVE-2026-0006 (Critical System RCE): This is a heap buffer overflow in the Media Codecs Mainline component (com[.]android[.]media.swcodec). It allows for Remote Code Execution (RCE) without user interaction, often triggered by processing a specially crafted media file.

Official announcement: Please refer to the link for details –

https://nvd.nist.gov/vuln/detail/CVE-2026-0006

CVE-2026-21385 (High-Severity Qualcomm Graphics): This is a memory corruption flaw in a Qualcomm graphics/display component. It stems from an integer overflow during memory allocation, specifically related to how memory alignments are handled. 

Official announcement: Please refer to the link for details –

https://nvd.nist.gov/vuln/detail/CVE-2026-21385

Uncategorized

Important Security Note – A significant vulnerability (CVE-2026-0047) was historically linked to this method due to a missing permission check. (12th Mar 2026)

Leave a comment

Preface: Important Security Note –

A significant vulnerability (CVE-2026-0047) was historically linked to this method due to a missing permission check. When modifying or using this method in custom ROM development, always ensure it is wrapped in a checkDumpPermission() call to prevent unauthorized local privilege escalation

Background: In the Android system, a standard application cannot read the output of a dump(FileDescriptor, String[]) Binder call without special permissions. This is a security measure designed to protect sensitive system state information.

While a regular app cannot programmatically trigger and read a dump, you can access this data using Android Debug Bridge (ADB):

•          High Privilege: The adb shell runs with a higher UID that is authorized to call dump() on system services.

•          Proto Output: For services like gfxinfo that support Proto format, you would use a command such as adb shell dumpsys gfxinfo <package_name> –proto to retrieve the structured data.

Reference (see below):

dumpsys is the “Legacy Text Report” we manually read to check system status.dumpBitmapsProto is the “Structured Data Snapshot” designed for automated programs (Java/C++).

Vulnerability details: In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Source: Mitre, NVD

Published: 2026-03-02

Updated: 2026-03-05

Official announcement: Please refer to the link for details – https://www.tenable.com/cve/CVE-2026-0047

System

Overcoming virtualization bottlenecks (Hyper-V & PCIe) 11th Mar 2026

Leave a comment

Preface: Microsoft Hyper-V is used less than Docker and Kubernetes (K8s) in modern application deployment primarily because Docker and K8s offer superior resource efficiency, portability, speed, and scalability, making them better suited for modern cloud-native architectures like microservices. Hyper-V, as a traditional hypervisor, provides robust isolation but operates at a different layer of the infrastructure stack with different use cases.

Background: In High-Performance Computing (HPC), integrating both CPUs and GPUs creates a Heterogeneous Computing environment. This approach combines the complementary strengths of both processors to maximize speed, energy efficiency, and flexibility.

Here are the primary reasons for this integration:

1. Specialized Task Allocation

CPU and GPU architectures are designed for different types of workloads:

•          CPU (Serial Specialist): With a few powerful cores, the CPU excels at complex logic, branching, and managing system resources (the “brain”).

•          GPU (Parallel Specialist): With thousands of smaller cores, the GPU is built to handle massive amounts of simple, repetitive mathematical operations simultaneously.

In the CUDA architecture, the CPU is called the Host, responsible for decision-making and “sending instructions”; the GPU is called the Device, responsible for “executing instructions”.

The most standard way to have the CPU instruct the GPU to execute 10 independent instruction units (or tasks) is to use CUDA Streams. Each Stream is like an independent pipeline, and you can distribute different tasks from the CPU to these 10 pipelines, allowing the H100 to process them in parallel.

How this code works (for your HPC background): Functionality: Overcomes virtualization bottlenecks (Hyper-V and PCIe). Please refer to the code in the attached diagram.

In Hyper-V environments, communication between the CPU and GPU is the biggest weakness:

  • Pinned Memory: Use cudaHostAlloc instead of regular malloc. This allows data to bypass the operating system’s page buffer and be transferred directly via DMA (Direct Memory Access), significantly improving PCIe throughput.
  • GPUDirect RDMA: If you have multiple VMs or multiple H100s, researching this technology allows the GPU to communicate directly with the network card or other GPUs, completely bypassing the CPU and virtualization OS layer.

End of article.

Potential Risk of CVE

CVE-2026-20660: A remote user may be able to write arbitrary files. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. (10th Mar 2026)

Leave a comment

Preface: App Groups provide the legal doorway for shared access, while libxpc’s path handling acts as the security guard ensuring no one sneaks a forbidden object through that door while it’s open.

Background: Libxpc is a closed-source system library in Apple iOS (and macOS) that powers the XPC (Cross Process Communication) framework. It enables secure, lightweight communication between different applications and system services, allowing processes to share data and perform tasks on behalf of one another. It is critical for app sandboxing, stability, and system security.

In Apple’s iOS, path handling within the libxpc library is a critical mechanism for ensuring that file paths are securely and accurately managed during communication between different processes.

The primary purposes and functions include: Security & Sandbox Enforcement, Privilege Isolation, Safe Resource Sharing, Service Discovery and Vulnerability Mitigation.

Remark: In system operations, CFNetwork frequently utilizes libxpc to execute specific tasks:

  • WebKit Networking: When browsers like Safari load pages, they use the com.apple.WebKit.Networking.xpc component to request resources. This involves CFNetwork communicating via XPC.
  • Background Transfers: For background downloads or syncs, CFNetwork interacts with system network daemons through XPC connections to maintain the session while the app is suspended.

Vulnerability detail: A path handling issue was addressed with improved logic. This issue is fixed in macOS Tahoe 26.3, macOS Sonoma 14.8.4, iOS 18.7.5 and iPadOS 18.7.5, visionOS 26.3, iOS 26.3 and iPadOS 26.3, Safari 26.3. A remote user may be able to write arbitrary files.

NVD Published Date: 02/11/2026
NVD Last Modified: 02/13/2026

Official announcement: Please refer to the link for details –

https://nvd.nist.gov/vuln/detail/CVE-2026-20660

Cell Phone (iPhone, Android, windows mobile), Potential Risk of CVE

CVE-2026-20667: About Apple iOS 26.3, iPadOS 26.3A….., logic issue was addressed with improved checks. (9th Mar 2026)

Leave a comment

Preface: As of March 8, 2026, Apple had released iOS 26.3.1 between March 4 and 5, 2026. Although you saw related news on March 7, this version mainly focused on bug fixes and performance optimizations for the major update released a few days earlier. The focus of this discussion is sandbox escape.

Background: iOS uses a centralized, kernel-level sandboxing system (Sandbox.kext) for all apps, primarily relying on a single default, complex profile named container.sb for all third-party applications. While the container is standard, iOS dynamically applies unique sandbox profiles to individual processes to restrict file system, hardware, and network access.

Apple states that App Groups allow multiple apps and extensions to access a shared container and perform interprocess communication.

That means:

  • App ✅
  • Widget ✅
  • Extension ✅
    …can all touch the same file path, simultaneously, in different processes.

The sandbox permits this — it does not serialize it for you.

Vulnerability details: A logic issue was addressed with improved checks. This issue is fixed in watchOS 26.3, macOS Tahoe 26.3, macOS Sonoma 14.8.4, macOS Sequoia 15.7.4, iOS 26.3 and iPadOS 26.3. An app may be able to break out of its sandbox.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2026-20667