-
CVE-2024-39489: Linux kernel enhance memory management on IPv6 feature (11 July 2024)
Preface: The Linux kernel implements most of its IPv6 parts from USAGI. USAGI project was founded to improve and develop Linux IPv6 stack. The integrated USAGI version/release is unknown. Implemented into the kernel are the core functions of USAGI; the “standard” user-level programs provide basic IPv6 functionality. Background: IPv6 converting to using crypto_pool has the…
-
CVE-2024-36138: Bypass incomplete fix of CVE-2024-27980 (10 Jul 2024)
Preface: Node. js has two types of threads: one Event Loop and k Workers. The Event Loop is responsible for JavaScript callbacks and non-blocking I/O, and a Worker executes tasks corresponding to C++ code that completes an asynchronous request, including blocking I/O and CPU-intensive work. Background: Why do we use child process in Node.js? Node…
-
CVE-2024-6563: About Renesas arm-trusted-firmware (9 Jul 2024)
Preface: Trusted Firmware-M (TF-M) defines several common profiles, such as Profile Small, Profile Medium, Profile Medium ARoT-less and Profile Large, to provide different levels of security to adapt to different device functions and applications. Use cases on top of firmware. Background: The capabilities and resources of different IoT devices can vary significantly. Some IoT devices…
-
CVE-2024-39486: Direct Rendering Manager (DRM) of video card. A race leads to use-after-free of a “struct pid” (8 Jul 2024)
Preface: The display pipeline driver responsible for interfacing with the display uses the kernel mode setting (KMS) API and the GPU responsible for drawing objects into memory uses the direct rendering manager (DRM) API. Background: The Direct Rendering Manager (DRM) is a subsystem of the Linux kernel responsible for interfacing with GPUs of modern video…
-
Get closer look CVE-2024-39920: About “SnailLoad” issue (5-Jul-2024)
NVD Published Date: 07/03/2024 Preface: How is RTT measured in TCP? Measures the time from sending a packet to getting an acknowledgment packet from the target host. Background: A new technology standard called “RFC 9293” was released on August 18, 2022. Highlight: -Acknowledgment Number: 32 bits – If the ACK control bit is set, this…
-
CVE-2024-39309: prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. (3-Jul-2024)
Preface: Parse was founded in 2011 by Tikhon Bernstam, Ilya Sukhar, James Yu, and Kevin Lacker, previously at Google and Y Combinator. An open source backend-as-a-service (BaaS) framework originally developed by Facebook. On January 28, 2016, Facebook open sourced the Parse Platform and announced that it would shut down the Parse hosting service. However, the…
-
CVE-2024-20081: Out-of-bounds write in gnss, response by Mediatek security advisory. (2nd July 2024)
Preface: GPS traditionally refers to the North American Global Positioning System, or satellite positioning system. GNSS is the term for the international multi-constellation satellite system. Therefore, GNSS typically includes GPS, GLONASS, Baidu, Galileo, and any other constellation system. Background: GNSS positioning modules or chips, as the core component of In-vehicle Infotainment systems, provide position, speed,…
-
CVE-2024-37371: About MIT Kerberos 5 (2nd July 2024)
Preface: Kerberos is built into all major operating systems, including those from Microsoft, Apple, Red Hat, and Sun. Kerberos is the authentication mechanism for some devices like Microsoft Active Directory and even X-Box. LDAP is primarily used for managing and accessing directories, while Kerberos is designed to provide security authentication for client/server applications. Background: MIT…
-
About CVE-2024-37571: SAS: Data and AI Solutions (SAS Broker – V9.2, build 1495) 26-June-2024
Preface: What’s required to create good machine learning systems? -Data preparation capabilities. -Algorithms – basic and advanced. -Automation and iterative processes. -Scalability. -Ensemble modeling. Did you know? -In machine learning, a target is called a label. -In statistics, a target is called a dependent variable. -A variable in statistics is called a feature in machine…
-
About CVE-2024-38952 on PX4-Autopilot v1.14.3 (27 June 2024)
Preface: The PX4 is a professional autopilot. Developed by world-class developers from industry and academia and supported by an active worldwide community, it powers a variety of vehicles from racing and cargo drones to ground vehicles and submersibles. Background: What is needed to control a drone using PX4 flight controller? -A computer with Internet Access.…