-
Multiple vulnerabilities were discovered in the TCP/IP stack (NetworkPkg) of Tianocore EDKII, Security focus of CVE-2023-4523 (5th Feb 2024)
Original article published January 2024, status update published January 23, 2024. Preface: Supermicro is aware of a potential vulnerability known as “PixieFAIL” in the BIOS firmware. Multiple vulnerabilities were discovered in the TCP/IP stack (NetworkPkg) of Tianocore EDKII, an open source implementation of UEFI. These nine vulnerabilities that if exploited via network can lead to…
-
About CVE-2018-1311: Security update for xerces-c provided by SUSE on Feb 2024. Why do design weakness can tolerance by HPC Operating system for long year? (02-02-2024)
Preface: Different HPC compilers allow the coder to make use of these tools for better performance and capability. For example, using HPC compilers allow for easier coding to run a parallel job. Compilation is the process of converting C language source code into executable program code. Running is the process of executing executable code. Compilation…
-
VE-2023-6780: Do not contempt his power! (1st Feb 2024)
Preface: The GNU C Library – The project provides the core libraries for the GNU system and GNU/Linux systems. GLib is a platform library which is used by many hundreds of projects outside of GNOME. Background: R is a language and environment for statistical programming which includes statistical computing and graphics. Python is a general-purpose…
-
CVE-2024-0564: A flaw was found in the Linux kernel’s memory deduplication mechanism. (30th Jan 2024)
Preface: KVM hypervisor enables full virtualisation capabilities. It provides each VM with all typical services of the physical system, including virtual BIOS (basic input/output system) and virtual hardware, such as processor, memory, storage, network cards, etc. As a result, every VM completely simulates a physical machine. Background: Kernel same-page Merging (KSM), used by the KVM…
-
CVE-2023-46805 and CVE-2024-21887 on Ivanti ICS 9[.]x, 22[.]x and Ivanti Policy Secure 9[.]x, 22[.]x (30-01-2024)
Preface: MobileIron was acquired by Ivanti on December 1, 2020. Ivanti acquired Pulse Secure that same year. As part of the acquisition, Pulse Secure has been renamed Ivanti Secure Access. Starting October 9, 2023, Pulse Secure/Ivanti Secure Access will be upgraded to the latest version of Ivanti Secure Access. Background: Ivanti Connect Secure (ICS) provides…
-
CVE-2023-6200: A race condition was found in the Linux Kernel.(29th Jan 2024)
Preface:An essential race condition occurs when an input has two transitions in less than the total feedback propagation time. Background: ICMPv6 over the Internet is important for Path MTU Discovery (which uses the ICMPv6 Packet Too Big message) since ipv6 routers don’t fragment packets. ICMPv6 is an integral part of IPv6 and performs error reporting…
-
CVE-2023-33036: NULL Pointer Dereference in Hypervisor (26th Jan 2024)
This Qualcomm security bulletin was originally published on 1st January 2024. Preface: One method of conducting these PDoS attacks is commonly referred to as phlashing. During such an attack, an attacker bricks a device or destroys firmware, rendering the device or an entire system useless. This is one method to exploit vulnerabilities and replace a…
-
CVE-2024-23212: Apple Neural Engine design has weakness in memory handling. (25th January 2024)
This announcement was originally published on January 22nd 2024 Preface: Neural networks, also known as artificial neural networks (ANNs) or simulated neural networks (SNNs), are a subset of machine learning and are at the heart of deep learning algorithms. Recent advances in artificial intelligence systems, such as voice or facial recognition programs, have benefited from neural networks, densely interconnected…
-
CVE‑2023‑31037: Design weakness on NVIDIA Bluefield 2 and Bluefield 3 DPU BMC (Updated 01/22/2024)
Preface: Virtio-net device emulation enables users to create VirtIO-net emulated PCIe devices in the system where the NVIDIA® BlueField® DPU is connected. Background: The Intelligent Platform Management Interface (IPMI) is a standard interface for hardware management used by system administrators to control the devices and monitor the sensors. For these, it is necessary the IPMI…
-
CVE-2023-34063: A vulnerability was discovered in VMware Aria Automation and Cloud Foundation that affects unknown components. (23rd Jan 2024)
Preface: The missing function-level access control vulnerability refers to the flaws in the authorization logic. By exploiting it, an attacker, who could be an existing user of the application, is able to escalate privileges and access restricted functionalities. Background: VMware Aria Automation Orchestrator. (formerly vRealize Orchestrator). VMware Aria is an intelligent multi-cloud management solution that…