-
In the Linux kernel, the CVE-2024-46713 vulnerability has been resolved. The AUX buffer is strictly a sub-buffer, serialize using aux_mutex to avoid complications. (16Sep 2024)
Preface: A mutex is a mutual exclusion lock. Only one thread can hold the lock. Mutexes are used to protect data or other resources from concurrent access. A mutex has attributes, which specify the characteristics of the mutex. Background: During the boot process, the console provides a lot of important information about the initial phase…
-
About Android Framework: Bypass CVE-2022-20338, formed CVE-2024-40662 (11th Sep 2024).
Preface: What is a malformed URI? The JavaScript exception “malformed URI sequence” occurs when URI encoding or decoding wasn’t successful. Background: URI definition In computer terms, a Uniform Resource Identifier (URI) is a string used to identify the name of a certain network resource. This identification allows users to interact with any resource (including local…
-
CVE-2024-45327: Design weakness on FortiSOAR! (12th Sep 2024)
Preface: In session hijacking, an attacker gets hold of a valid user session to gain unauthorized access to the account. This is typically done through three methods: Brute force: The attacker keeps trying session IDs until they are successful. Calculation: If the session IDs are generated in a non-random manner, the attacker can calculate them.…
-
CVE-2024-40754: Heap-based Buffer Overflow vulnerability in Samsung Open Source Escargot JavaScript engine (11th Sep 2024)
Preface: A stack is not flexible, the memory size allotted cannot be changed whereas a heap is flexible, and the allotted memory can be altered. Background: Escargot is a memory optimized JavaScript engine for mid-range devices such as mobile phone, tablet and TV. C++. •. GNU Lesser General Public License v2.1. Memory Efficiency: The engine…
-
CVE-2024-33050 – Buffer Over-read in WLAN Host Communication (10th Sep 2024)
Preface: In computer programming, transient is a property of any element in the system that is temporary. The term applies to transient applications. Background: Within frequency, In-band discovery is used for communication between 6 GHz devices. There are three in-band discovery methods: Fast Initial Link Setup (FILS) and Unsolicited Probe Response (UPR) frames are passive…
-
CVE-2024-42024: veeam did not disclosed the details, perhaps this story can tell (9th Sep 2024)
Preface: Veeam ONE agent is a component that enables communication with Veeam Backup & Replication servers, performs collection of logs, and sends remediation commands. It is recommended to install Veeam ONE agent to improve data collection performance in large-scale Veeam Backup & Replication infrastructures. Background: Veeam ONE supports two deployment scenarios: • All-in-one The all-in-one…
-
CVE-2024-7884 – Fix memory leak in CallFuture (6th Sep 2024)
Preface: The world’s first web-speed, internet-scale public blockchain. At the virtual event launching Sodium on September 30, 2022, the DFINITY Foundation will launch the Network Nervous System, an open algorithmic governance system that controlling the Internet computer. The event will also showcase in-depth technical material on advanced cryptography, consensus protocols, and token economics. Background: Inter–canister…
-
CVE-2024-44961: Forward soft recovery errors to userspace (5th Sep 2024)
Preface: The AMD Radeon Instinct™ MI50 server accelerator designed on the world’s First 7nm FinFET technology process brings customers a full-feature set based on the industry’s newest technologies. The MI50 is AMD’s workhorse accelerator offering that is ideal for large scale deep learning. Delivering up to 26.5 TFLOPS of native half-precision (FP16) or up to…
-
CVE-2024-3655: Mali GPU Kernel Driver allows improper GPU memory processing operations (3rd Sep 2024).
Preface: Use after free errors sometimes have no effect and other times cause a program to crash. While it is technically feasible for the freed memory to be re-allocated and for an attacker to use this reallocation to launch a buffer overflow attack. Background: When the GPU returns ownership of the buffer to the CPU,…
-
CVE-2024-38401: Use After Free in Qualcomm IPC (3rd Sep 2024)
Preface: Race conditions arise when multiple threads attempt to access a shared resource without proper synchronization, often leading to vulnerabilities such as concurrent use-after-free. To mitigate their occurrence, operating systems rely on synchronization primitives such as mutexes, spinlocks, etc. Background: The Qualcomm Type 1 Hypervisor facilitates the hosting of multiple trusted execution environments for secure…