-
Is AMD Instinct™ MI300X affected by CVE-2023-4969 (GPU memory leak). AMD has the answer. Official announcement on May 7, 2024.
This article was published on May 21, 2024. Preface: When I see the vulnerability it shows the date far away from now. Sometimes I lose interest. Maybe I’m missing a major technical detail. AMD officially released CVE-2023-4869 on March 7, 2024. It happened to wake me up! Although today is May 21, 2024, it seems…
-
CVE-2024-23664: CW:601 was fixed by Fortinet (20th May 2024)
Initial publication: 14th May 2024 Preface: What happens if a website uses a user-supplied URL in a URL fragment to redirect the logged-in user to the requested page? Background: CWE 601 – An open redirect vulnerability occurs when an application allows the user to control redirects or forward to another URL. If the application does…
-
CVE-2024-21792: Time-of-check Time-of-use race conditionin Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: Intel Neural Compressor is an open…
-
CVE-2024-22476: Improper input validation in some Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: Intel Neural Compressor performs model optimization to reduce the model size and increase the speed of deep learning inference for deployment on CPUs or GPUs. Background: Intel Neural Compressor is an open source Python* library that performs model compression techniques such as quantization, pruning, and knowledge distillation across multiple deep learning frameworks including TensorFlow*,…
-
About CVE-2024-22252: Recently, Broadcom VMware has often repeated previous CVE posts. Maybe it’s a new company policy or necessary? (14-May-2024)
Official last updated on May 8, 2024. An early advisory for this vulnerability was issued on March 5, 2024. Preface: If you recall, this design flaw was discovered in April 2021. Has it been fixed? Or it is vendors fine-tuned their vulnerability management strategies? Background: A Transfer Ring is an array of Transfer Request Blocks…
-
CVE-2024-21474: Qualcomm did not disclose technical details. Could this situation cause this problem? (6th May 2024)
Preface: The Qualcomm Snapdragon X65 5G Modem is the baseband chipset used in the iPad Pro (11-inch) (4th generation), iPad Pro (12.9-inch) (6th generation), iPhone 14, iPhone 14 Plus, iPhone 14 Pro and iPhone 14 Pro Max. Background: A power management integrated circuit (PMIC) is used to manage power on an electronic devices or in…
-
About VMware Enhanced Authentication Plug-in (EAP): VMware urges customers to remain alert for CVE-2024-22245 and CVE-2024-22250. (May 7, 2024)
This announcement original published on 20th Feb 2024 Preface: When two components have problems in the same place. If vendor did not specify the details in clear. In this circumstances, the design weakness looks the same. Background: The Enhanced Authentication Plugin (EAP) is an extra software package that doesn’t come pre-installed. Administrators need to install…
-
Android Security Bulletin – May 2024 There’s a lot you can explore (9 May 2024)
Preface: Heard that Long-term support (LTS) for Linux kernels is being reduced from six to two years now. Background: Greg Kroah-Hartman is a major Linux kernel developer. As of April 2013, he is the Linux kernel maintainer for the -stable branch, the staging subsystem, USB, driver core, debugfs, kref, kobject, and the sysfs kernel subsystems,…
-
CVE-2024-1067: Mali GPU Kernel Driver allows improper GPU memory processing operations (8 May 2024)
Date of issue: 3rd May 2024 Preface: The Mali-G720 and Mali-G620 GPUs complete the world-class GPU portfolio for a wide range of consumer devices. After four generations of GPUs on the fourth-generation Valhall architecture, the latest Arm GPUs are built on a new fifth-generation GPU architecture (called Gen 5). Background: The New 5th Gen Arm…
-
CVE-2024-33602: Name Service Cache Daemon’s (nscd) design limitation (6 May 2024)
Preface: Kubernetes creates DNS records for Services and Pods. You can contact Services with consistent DNS names instead of IP addresses. Kubernetes publishes information about Pods and Services which is used to program DNS. Kubelet configures Pods’ DNS so that running containers can lookup Services by name rather than IP. Background: When nscd enabled, this…