-
About CVE-2024-20084 and CVE-2024-20085: MediaTek’s System-on-Chip Design weakness (2nd Sep 2024)
Preface: When an out-of-bounds read occurs, typically the product has already made a separate mistake, such as modifying an index or performing pointer arithmetic that produces an out-of-bounds address. Background: MediaTek JPEG Decoder is the JPEG decode hardware present in MediaTek SoCs. The jpeg decoder hardware device node which should be added as subnodes to…
-
CVE‑2024-0110: Supercomputer and AI development Interlude (II) (30th Aug 2024)
Preface: OpenAI revealed that the project cost $100 million, took 100 days, and used 25,000 NVIDIA A100 GPUs. Each server equipped with these GPUs uses approximately 6.5 kW, so an estimated 50 GWh of energy is consumed during training. Background: Parallel processing is a method in computing of running two or more processors (CPUs) to…
-
CVE-2024-34731: last week CVEs, today story. (29th Aug 2024)
Preface: A race condition vulnerability is a software bug that allows these unexpected results to be exploited by malicious entities. The Race condition is a privilege escalation vulnerability that manipulates the time between imposing a security control and using services in a UNIX like system. This vulnerability is a result of interferences caused by multiple…
-
CVE-2024-8105: let you aware that computer industry not secure! (2024-08-26)
Preface: The key leaked in 2023, it was one of the test dummy keys that AMI was shipping since as early as May 2012, said security firm. The so-called Platform Key (PK) from American Megatrends International (AMI) serves as the root of trust during the Secure Boot PC startup chain, and verifies the authenticity and…
-
CVE-2024-44932: idpf: fix UAFs when destroying the queues (26th Aug 2024)
Preface: XDP, or eXpress Data Path, is a Linux networking feature that enables you to create high-performance packet-processing programs that run in the kernel Background: idpf Linux Base Driver supports XDP (Express Data Path) and AF_XDP zero-copy. Note that XDP is blocked for frame sizes larger than 3KB. The idpf driver serves as both the…
-
CVE-2024-42340 –> CWE-602: Client-Side Enforcement of Server-Side Security (26th Aug 2024)
Preface: CyberArk Identity creates a set of JavaScript objects, global variables, and global methods for each SAML user session. These objects provide information that a user map script or a custom SAML script can read and act on. Background: Application access policies with JavaScript – If you want more specific control over when users can…
-
CVE-2024-45163: The 1st time seen CVE -related to malware vulnerability. (22nd Aug 2024)
Preface: Mirai is malware that turns networked devices running Linux into remotely controlled bots that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers. Background: The Mirai botnet connects to the CNC (command and control) server via simultaneous TCP.…
-
CVE-2023-31315: AMD SMM Lock Bypass (21-Aug-2024)
Preface: AMD EPYC™ Processors power the highest-performing x86 servers for the modern data center, on prem and in cloud environments, across industries. Background: Model-specific registers (MSR) are control registers provided by the processor implementation so that system software can interact with a variety of features, including performance monitoring, checking processor status, debugging, program tracing or…
-
CVE-2023-52910 – iommu/iova: Fix alloc iova overflows issue (21-08-2024)
Preface: Modern hardware provides an I/O memory management unit (IOMMU) that mediates direct memory accesses (DMAs) by I/O devices in the same way that a processor’s MMU mediates memory accesses by instructions. Background: With IOMMU, when the device performs DMA access to memory, the system returns to the device driver no longer a physical address,…
-
CVE-2024-44070: FRRouting (FRR) – bgpd – ensure the hash works (18th Aug 2024)
Preface: As Time Goes By , OSS (Open Source Software) for use by cost-conscious commercial companies. It is quite popular in cloud. Background: FRRouting (FRR) is a free and open source Internet routing protocol suite for Linux and Unix platforms. It implements BGP, OSPF, RIP, IS-IS, PIM, LDP, BFD, Babel, PBR, OpenFabric and VRRP, with…