-
CVE-2024-5274: Google Chrome fixed remote code execution vulnerability (28-05-2024)
Preface: Every time I start learning CVE. It helps me enrich my knowledge. Even though it was released months ago. Background: V8 is a JavaScript and WebAssembly engine developed by Google for its Chrome browser. Each WebAssembly module executes within a sandboxed environment separated from the host runtime using fault isolation techniques. Ref: wasmtime is a…
-
Apple security updates on 20th May 2024, But it has not published CVE entries. Observe how Apple handled in the past, maybe you can find it in a CVE few months from now. (27-05-2024)
Preface: Apple released iOS 17.5 and iPadOS 17.5 on May 20, 2024, which fixed multiple security vulnerabilities. I heard that some users found that photos they had deleted years ago suddenly appeared in recent albums as new photos. Background: The attached pictures document some rare occurrences. For example, which IOS version still support 32 bit…
-
CVE-2024-23354 Memory corruption when the IOCTL call is interrupted by a signal. (24May 2024)
Originally published on May 6, 2024 Preface: The Snapdragon 8 Gen 2 Mobile Platform defines a new premium standard for connected computing. Intelligently engineered with groundbreaking AI across the board, this AI marvel enables truly extraordinary experiences. Background: A vertex buffer object (VBO) is an OpenGL feature that provides methods for uploading vertex data (position,…
-
CVE-2024-22274: vCenter design weakness. Does it similar to this way? (23 May 2024)
Preface: In computer security, arbitrary code execution (ACE) is an attacker’s ability to run any commands or code of the attacker’s choice on a target machine or in a target process. An arbitrary code execution vulnerability is a security flaw in software or hardware allowing arbitrary code execution. Background: vCenter Server is the centralized management…
-
CVE-2024-36008: The impact may be widespread but has been resolved. Linux, you did a great job. (21May 2024)
Preface: Syzbot has begun to report kernel findings to LKML in 2017. Syzbot is a continuous kernel build / fuzz / report aggregation system. Background: Linux has two mechanisms for setting routes, one is fib, and the other is routing generated by dynamic. fib uses route (man 8 route) to specify a static route table.…
-
Is AMD Instinct™ MI300X affected by CVE-2023-4969 (GPU memory leak). AMD has the answer. Official announcement on May 7, 2024.
This article was published on May 21, 2024. Preface: When I see the vulnerability it shows the date far away from now. Sometimes I lose interest. Maybe I’m missing a major technical detail. AMD officially released CVE-2023-4869 on March 7, 2024. It happened to wake me up! Although today is May 21, 2024, it seems…
-
CVE-2024-23664: CW:601 was fixed by Fortinet (20th May 2024)
Initial publication: 14th May 2024 Preface: What happens if a website uses a user-supplied URL in a URL fragment to redirect the logged-in user to the requested page? Background: CWE 601 – An open redirect vulnerability occurs when an application allows the user to control redirects or forward to another URL. If the application does…
-
CVE-2024-21792: Time-of-check Time-of-use race conditionin Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: Intel Neural Compressor is an open…
-
CVE-2024-22476: Improper input validation in some Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: Intel Neural Compressor performs model optimization to reduce the model size and increase the speed of deep learning inference for deployment on CPUs or GPUs. Background: Intel Neural Compressor is an open source Python* library that performs model compression techniques such as quantization, pruning, and knowledge distillation across multiple deep learning frameworks including TensorFlow*,…
-
About CVE-2024-22252: Recently, Broadcom VMware has often repeated previous CVE posts. Maybe it’s a new company policy or necessary? (14-May-2024)
Official last updated on May 8, 2024. An early advisory for this vulnerability was issued on March 5, 2024. Preface: If you recall, this design flaw was discovered in April 2021. Has it been fixed? Or it is vendors fine-tuned their vulnerability management strategies? Background: A Transfer Ring is an array of Transfer Request Blocks…