-
CVE-2024-21474: Qualcomm did not disclose technical details. Could this situation cause this problem? (6th May 2024)
Preface: The Qualcomm Snapdragon X65 5G Modem is the baseband chipset used in the iPad Pro (11-inch) (4th generation), iPad Pro (12.9-inch) (6th generation), iPhone 14, iPhone 14 Plus, iPhone 14 Pro and iPhone 14 Pro Max. Background: A power management integrated circuit (PMIC) is used to manage power on an electronic devices or in…
-
About VMware Enhanced Authentication Plug-in (EAP): VMware urges customers to remain alert for CVE-2024-22245 and CVE-2024-22250. (May 7, 2024)
This announcement original published on 20th Feb 2024 Preface: When two components have problems in the same place. If vendor did not specify the details in clear. In this circumstances, the design weakness looks the same. Background: The Enhanced Authentication Plugin (EAP) is an extra software package that doesn’t come pre-installed. Administrators need to install…
-
Android Security Bulletin – May 2024 There’s a lot you can explore (9 May 2024)
Preface: Heard that Long-term support (LTS) for Linux kernels is being reduced from six to two years now. Background: Greg Kroah-Hartman is a major Linux kernel developer. As of April 2013, he is the Linux kernel maintainer for the -stable branch, the staging subsystem, USB, driver core, debugfs, kref, kobject, and the sysfs kernel subsystems,…
-
CVE-2024-1067: Mali GPU Kernel Driver allows improper GPU memory processing operations (8 May 2024)
Date of issue: 3rd May 2024 Preface: The Mali-G720 and Mali-G620 GPUs complete the world-class GPU portfolio for a wide range of consumer devices. After four generations of GPUs on the fourth-generation Valhall architecture, the latest Arm GPUs are built on a new fifth-generation GPU architecture (called Gen 5). Background: The New 5th Gen Arm…
-
CVE-2024-33602: Name Service Cache Daemon’s (nscd) design limitation (6 May 2024)
Preface: Kubernetes creates DNS records for Services and Pods. You can contact Services with consistent DNS names instead of IP addresses. Kubernetes publishes information about Pods and Services which is used to program DNS. Kubelet configures Pods’ DNS so that running containers can lookup Services by name rather than IP. Background: When nscd enabled, this…
-
Starting from CVE-2024-34476, other design flaws have also been found, please use non-vulnerable Open5GS versions for development. (4-May-2024)
Preface: The two prerequisites for running Open5GS are the Open5GS core and MongoDB. The MongoDB, a document-based database, for user equipment registration. MongoDB uses some weird special processor instruction, which is not provided in intel Celeron processor. Background: The Access and Mobility Management Function (AMF) is one of the control plane network functions (NF) of…
-
Will such scenario be similar to the CVE-2024-0087 mentioned? (3May 2024)
Preface: NVIDIA Triton Inference Server, part of the NVIDIA AI platform and available with NVIDIA AI Enterprise, is open-source software that standardizes AI model deployment and execution across every workload. Background: The Triton Inference Server is available as a pre-built Docker container or you can build it from source.The Triton Docker container is available on…
-
Regarding CVE-2024-4058: Closer Look and Speculation at Google Chrome Design Flaw (01-May-2024)
Preface: Type confusion vulnerability can be powerful. According to Common Weakness Enumeration (CWE) The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. When the program accesses the resource using an incompatible…
-
CVE-2024-31621: The flowise version <= 1.6.5 is vulnerable to authentication bypass (29-04-2024)
Preface: What are LLM Apps? LLM apps, or Large Language Model applications, are applications that leverage the capabilities of Large Language Models (LLMs) to perform a variety of tasks. LLMs are a type of artificial intelligence (AI) that uses deep learning techniques and large datasets to understand, generate, and predict new content. Background: Flowise uses…
-
AMD urged software developers to implement best practices to avoid secret-dependent data accesses or control flows. (28-04-2024)
Originally published on April 26, 2024. Preface: (Level 3 cache) A memory bank built onto the motherboard or within the CPU module. The L3 cache feeds the L2 cache, and its memory is typically slower than the L2 memory, but faster than main memory. Background: The last-level cache (LLC) is the last chance for memory…