-
CVE-2024-2612: Self referencing object could have potentially led to a use-after-free (20-03-2024)
Preface: If you want the best internet browser that puts security first, not data collection, then Firefox is your best bet. Background: Smart pointers are C++ objects that not only store a pointer to a dynamically allocated resource but also manage the lifetime cycle of that resource, ensuring it is properly deallocated when no longer…
-
CVE-2024-21661: Argo CD suffers denial of service (DoS) vulnerability (18-03-2024)
Preface: What does multi threaded environment mean? Multithreading is the ability of a program or an operating system to enable more than one user at a time without requiring multiple copies of the program running on the computer. Background: Argo CD is implemented as a Kubernetes controller which continuously monitors running applications and compares the…
-
CVE-2024-28862: The Ruby One Time Password library (ROTP) Affected versions had overly permissive default permissions (18-03-2024)
Preface: In this rushed, demanding digital world, people don’t think about what the back-end platform or its design is. Therefore, vulnerability management actually relies on vendors and software developers. Background: Ruby on Rails is forming a niche as it is used by millions of websites, which includes well-known companies like Github, Shopify, Airbnb, Fiverr and…
-
CVE-2024-2193: Specter v1 variant inheriting the Specter v1 vulnerability. So called GhostRace. AMD believes the previous guidance remains applicable to mitigate this vulnerability (15-03-2024)
AMD made this announcement on March 12, 2024. Preface: Spectre variant 1 attacks take advantage of speculative execution of conditional branches, while Spectre variant 2 attacks use speculative execution of indirect branches to leak privileged memory. Background: Speculative execution improves speed by operating on multiple instructions at once—possibly in a different order than when they…
-
About CVE-2023-39368: The machine learning process requires CPUs and GPUs. Does bus lock regulator mechanism impact this area? Glad to tell, the problem fixed. (14-03-2024)
CVE-2023-39368 was published on 13th March 2024. In fact, Intel solve this problem since the end of 2020. Maybe hesitant about this design weakness. So it wasn’t announced until this month. Preface: What is Intel E core? While P cores are focused on delivering peak performance for intensive workloads, E cores ensure that the system…
-
Could CVE-2022-2637 and CVE-2023-38575 be the same? (13th March 2024)
Preface: In August 2022, CVE-2022-26373 told that Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access. It looks that same vulnerability with new CVE reference number. What’s going on? CVE-2023-38575 was published on 13th March 2024. Background: Fundamentally, branch…
-
CVE-2023-46839: Fixed memory access through PCI device with phantom functions (XSA-449) 12th Mar 2024
Preface: SUSE’s partnership with HPE Cray dates back to the early 1990s, pre HPE’s acquisition of Cray, and the entire time SUSE has been collaborating on Cray OS – a specialized version of SUSE Linux Enterprise Server. Background: The hypervisor needs to manipulate the interaction between the guest OS and the associated physical device. PCI…
-
CVE-2024-23278: An app may be able to break out of its sandbox (11thMar 2024)
Vulnerability CVE-2024-23278 was released on March 7, 2024. Apple didn’t reveal specific details, so let’s see if we can dig out any clues. Preface: XPC has a sizeable portion of undocumented functionality, including its implementation (for example, the main project libxpc is closed source). XPC provides a public API at two levels: low-level and Foundation…
-
International Space Station slipping across the Moon’s face as it flies by at 8 kilometers per second (8th Mar 2024)
-
CVE-2023-28582 Buffer Copy Without Checking Size of Input in Data Modem (8th Mar 2024)
This issue was fixed on 2023/09/04. But the vendor did not announce the vulnerability until today (March 8, 2024). Preface: Datagram Transport Layer Security (DTLS) is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designed to prevent eavesdropping, tampering, or message forgery. Background: 5G security standards bring…