-
In the Linux kernel, CVE-2024-26921 vulnerability has been resolved. openvswitch is safe again. (19th Apr 2024)
Preface: Open vSwitch is a production quality, multilayer virtual switch licensed under the open source Apache 2.0 license. It is designed to enable massive network automation through programmatic extension, while still supporting standard management interfaces and protocols (e.g. NetFlow, sFlow, IPFIX, RSPAN, CLI, LACP, 802.1ag). In addition, it is designed to support distribution across multiple physical…
-
CVE-2024-31580 – PyTorch before v2.2.0 contain a heap buffer overflow vulnerability (18th Apr 2024)
Preface: Using the C++ new operator, we can allocate memory at the runtime. The new operator in C++ is used for the dynamic memory allocation; It is used to allocate the memory at runtime on heap memory. Background: PyTorch is a deep learning framework open sourced by Facebook in early 2017. It is built on…
-
CVE-2024-27086: MSAL.NET applications susceptible to local denial of service in authentication flows (17th April 2024)
Preface: Upgrade from Xamarin to [.]NET, Microsoft support for Xamarin will end on May 1, 2024 for all Xamarin SDKs including Xamarin.Forms. Background: The Microsoft Authentication Library (MSAL) enables developers to acquire security tokens from the Microsoft identity platform to authenticate users and access secured web APIs. It can be used to provide secure access…
-
CVE-2024-3092: DevOps deploy GitLab staying alert! (16-04-2024)
Original article published 5 days ago (April 11, 2024) Preface: Considering the difference in security points of GitHub and GitLab, GitLab is more secure than GitHub, while GitHub is less secure because it does not have authorization compliance. Another difference between GitLab and GitHub is that GitLab is a cloud-native application while GitHub is used…
-
CVE-2024-24862: In function pci1xxxx_spi_probe, there is a potential null pointer weakness found. (15-04-2024)
Preface: Ref: ENOMEM – no memory can be allocated by a function in the library. Note that malloc, calloc, and realloc do not set errno to ENOMEM on failure, but other library routines (the remedy display on diagram) may set errno to ENOMEM when memory allocation fails. Technical reference: What is the function of probe…
-
In the Linux kernel, the vulnerability (CVE-2024-26817) has been resolved (14-April-2024)
Preface: AMD already uses APUs in a variety of retail chips under the Ryzen and Threadripper brandings, such as “Opteron” server chips, as well as mobile and ultramobile chips designed for laptops and other low-power devices. Background: As of 2022, AMD Kernel Fusion Driver (KFD) is now integrated in this one kernel module. AMD KFD…
-
CVE-2024-31861: Improper Control of Generation of Code (Code Injection) vulnerability in Apache Zeppelin. (12-April-2024)
Preface: Training is the most important step in machine learning. In training, you pass the prepared data to your machine learning model to find patterns and make predictions. It results in the model learning from the data so that it can accomplish the task set. Background: What is Apache Zeppelin? Apache Zeppelin is an open-source,…
-
Why does Arm not affected by CVE-2024-2201? (11-Apr-2024)
Preface: I believed that similar type of design weakness known last year by Arm (Feb 2023). May be it fixed it already. Background: Linux kernel on Intel systems is susceptible to Spectre v2 attacks. CVE-2022-0001 explained Non-transparent sharing of branch predictor selectors between contexts in some Intel(R) Processors may allow an authorized user to potentially…
-
When Intel met Heckle – hypervisor’s interrupt injection behavior on Intel TDX (10th April 2024)
Technical report shared by ETH Zurich on 4th April 2024: Please refer to the link for details – https://arxiv.org/html/2404.03387v1 Background: Intel CPU’s inbuilt TDX Module provides an interface for the hypervisor to manage VMs indirectly and offers new instructions, VMLAUNCH-VMX and VMRESUME, for starting and resuming a VM. Instead of keeping track of the owner…
-
AMD response to technical article (Heckler – Disrupting AMD SEV-SNP with interrupts) (9th Apr 2024)
Preface: AMD Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) is a feature of AMD EPYC processors that adds strong memory integrity protection to help prevent malicious hypervisor-based attacks in order to create an isolated execution environment. Background: Fundamentally, int means interrupt, and the number 0x80is the interrupt number. An interrupt transfers the program flow to whomever…