-
CVE-2024-1086 : A use-after-free vulnerability in the Linux kernel’s netfilter. The IoT world remins vigilant. 4 June 2024
Preface: By default, OpenWrt builds the kernel with a useful set of netfilter capabilities for a robust router. NAT. REJECT. REDIRECT. CONNTRACK. LOG. OpenWrt is a Linux distribution suitable for embedded devices. Currently, many embedded hardware platforms on the market use OpenWrt as their basis, such as routers, network gateways or industrial use computer Background:…
-
About CVE-2024-36843: libmodbus v3.1.6 design weakness (3 June 2024)
Preface: Modbus is a communication protocol widely used in the field of industrial automation. It provides a standardized method for devices to communicate with each other over the network, making it an important tool for connecting and controlling various industrial equipment. Background: libmodbus supports the following functions: Vulnerability details: libmodbus v3.1.6 was discovered to contain…
-
CVE-2024-0103 – NVIDIA Triton Inference Server for Linux hit Incorrect Initialization of Resource vulnerability (31-05-2024)
Preface: AI-powered systems analyse the severity of the vulnerability, potential impact, and exploitability and prioritise patches based on the criticality of the vulnerability. Perhaps AI contains self diagostic and do remedy by himself! Background: An open-source software that helps standardize model deployment and delivers fast and scalable AI in production. Vulnerability details: CVE-2024-0103 Information disclosure…
-
CVE-2024-38016: tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (29-05-2024)
Preface: In the Linux Kernels n_gsm serial line discipline, which can be exploited by local attackers to gain kernel level root access. It original published by other Linux brand on 8th May 2024. Background: In Unix systems, a tty (which is short for “teletypewriter”) is the standard representation of a terminal device, with at least…
-
Red Hat security advisory: Important – glibc security update (29-05-2024)
Preface: You can clear the cache of nscd by performing the following actions: Execute the following command: sudo /etc/init[.]d/nscd restart. Background: Nscd is a daemon that provides a cache for the most common name service requests. The default configuration file, /etc/nscd. conf, determines the behavior of the cache daemon. The glibc packages provide the standard…
-
CVE-2024-5274: Google Chrome fixed remote code execution vulnerability (28-05-2024)
Preface: Every time I start learning CVE. It helps me enrich my knowledge. Even though it was released months ago. Background: V8 is a JavaScript and WebAssembly engine developed by Google for its Chrome browser. Each WebAssembly module executes within a sandboxed environment separated from the host runtime using fault isolation techniques. Ref: wasmtime is a…
-
Apple security updates on 20th May 2024, But it has not published CVE entries. Observe how Apple handled in the past, maybe you can find it in a CVE few months from now. (27-05-2024)
Preface: Apple released iOS 17.5 and iPadOS 17.5 on May 20, 2024, which fixed multiple security vulnerabilities. I heard that some users found that photos they had deleted years ago suddenly appeared in recent albums as new photos. Background: The attached pictures document some rare occurrences. For example, which IOS version still support 32 bit…
-
CVE-2024-23354 Memory corruption when the IOCTL call is interrupted by a signal. (24May 2024)
Originally published on May 6, 2024 Preface: The Snapdragon 8 Gen 2 Mobile Platform defines a new premium standard for connected computing. Intelligently engineered with groundbreaking AI across the board, this AI marvel enables truly extraordinary experiences. Background: A vertex buffer object (VBO) is an OpenGL feature that provides methods for uploading vertex data (position,…
-
CVE-2024-22274: vCenter design weakness. Does it similar to this way? (23 May 2024)
Preface: In computer security, arbitrary code execution (ACE) is an attacker’s ability to run any commands or code of the attacker’s choice on a target machine or in a target process. An arbitrary code execution vulnerability is a security flaw in software or hardware allowing arbitrary code execution. Background: vCenter Server is the centralized management…
-
CVE-2024-36008: The impact may be widespread but has been resolved. Linux, you did a great job. (21May 2024)
Preface: Syzbot has begun to report kernel findings to LKML in 2017. Syzbot is a continuous kernel build / fuzz / report aggregation system. Background: Linux has two mechanisms for setting routes, one is fib, and the other is routing generated by dynamic. fib uses route (man 8 route) to specify a static route table.…