-
Through the patched CVE-2024-0132 fixing Docker vulnerability (CVE-2024-9348) 17th Oct 2024
Preface: When artificial intelligence gains enough intelligence, do you know what it will say if it knows that software or applications developed by humans have vulnerabilities? He would say “Fxxx”! Background: Docker Engine is the fundamental containerization engine that runs on servers and manages containers, while Docker Desktop is a developer-focused tool that includes Docker…
-
CVE-2024-0129 – Path traversal issue discovered in NVIDIA NeMo (16-Oct-2024)
Preface: If successful, a path traversal attack may result in the following risks: Unauthorized data access: An attacker can gain access to sensitive files, such as configuration files, system files, or source code, which may include Credentials, application code and data, and sensitive operating system files. Background: NVIDIA NeMo™ is an end-to-end platform for developing…
-
About AMD-SB-7025 and AMD-SB-3013: Technical research papers provided to AMD (15-Oct-2024)
Preface: Examples of side channel attacks include timing attacks, cache-based attacks, and network traffic analysis. Mitigating side channel attacks involves implementing secure coding practices, employing cryptographic algorithms resistant to side channels, and minimizing timing differences. Background: Cache side channel attacks can infer the secret information processed by the victim by measuring the victim’s cache usage…
-
CVE-2024-45184: Design weakness found in Exynos, a system-on-chip based on Samsung’s ARM development (October 14, 2024)
Preface: USAT (USIM Application Toolkit) technology is based on the original passive operation mode of the SIM card and adds the new active operation capability of the SIM card, which allows applications and services in the SIM card to actively interact with mobile terminals. Background: The USAT (USIM Application Toolkit) is a standardized set of…
-
CVE-2024-47670: ocfs2 – add bounds checking (10-10-2024)
Preface: OCFS2 is a file system. It allows users to store and retrieve data. The data is stored in files that are organized in a hierarchical directory tree. It is a POSIX compliant file system that supports the standard interfaces and the behavioral semantics as spelled out by that specification. Background: OCFS2 is a useful…
-
Is Qualcomm CVE-2024-23369 the same as CVE-2022-33278? (9th Oct 2024)
Preface: Security patches can be divided into 2 categories — HLOS (High Level Operating System) and NON-HLOS. The first category is for patches concerning the Android system itself and the Linux kernel, and the other is about code running at much lower levels. Background: The software image running on the main processor is termed as…
-
About CVE-2024-33066: Memory corruption while redirecting log file to any file location with any file name, said Qualcomm (8th Oct 2024)
Preface: To redirect the standard error output of a command to a file in the Linux shell, you can use the “2>” operator followed by the name of the file where you want to redirect the stderr. Additionally, you can combine the stderr and stdout streams using the “2>&1” operator if you want to redirect…
-
CVE-2024-38812: Is it a known design weakness in past or it is a new findings? (7th Oct 2024)
Preface: System-Dependent IDL Preprocessor Variables The following system-dependent preprocessor variables are used in building the IDL compiler. They are all defined in: dce-root-dir/dce/src/rpc/idl/idl_compiler/sysdep[.]h AUTO_HEAP_STACK_THRESHOLD defines an estimate for the maximum size of a stack in a server stub. If the IDL compiler estimates that this amount will be exceeded, objects will be allocated via malloc…
-
CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
Preface: Kafka understands only byte arrays. Kafka acts as a Broker to convert and transmit data over the network between producers and consumers. But it need a mechanism to convert data into a format that Kafka, producers and consumers can understand. Background: Apache Avro is a powerful data serialization framework that provides many useful features.…
-
CVE‑2024-0103, CVE-2024-0104 & CVE-2024-0105 Interference from the development of supercomputers and artificial intelligence (3rd Oct 2024)
Preface: OpenAI revealed that the project cost $100 million, took 100 days, and used 25,000 NVIDIA A100 GPUs. Each server equipped with these GPUs uses approximately 6.5 kW, so an estimated 50 GWh of energy is consumed during training. Background: Parallel processing is a method in computing of running two or more processors (CPUs) to…