-
CVE-2024-2885: Use after free in Dawn in Google Chrome (26th Mar 2024)
Preface: WebGPU is a JavaScript API provided by a web browser that enables webpage scripts to efficiently utilize a device’s graphics processing unit (GPU). Google has enabled WebGPU support by default in Chrome 121, the latest version of its Chrome browser. Background: WebGPU sees physical GPU hardware as GPUAdapters. It provides a connection to an…
-
To be new or it was former: Rowhammer Attacks on AMD Zen-Based Platforms. So called ZenHammer (25-03-2024)
Preface: It is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations, said researchers at ETH Zurich. Background: When high-energy charged particles pass through the crystal lattice of a silicon wafer, their charges can interfere with the electrons within the lattice itself and…
-
CVE-2024-29059 – [.]NET Framework Information Disclosure Vulnerability (24th Mar 2024)
Preface: Microsoft did not tell the details of the vulnerability! What happened to the .NET Framework? Can we guess what happened? [.]NET is a platform framework. Currently, there are two types: the [.]NET Framework exclusive to the Windows platform and the cross-platform .NET Core. Background: The [.]NET Framework works with applications developed in C#, F#,…
-
What are the security updates for 17.4.1? Apple, as always, won’t tell you the details of the vulnerability! (22-03-2024)
Preface: iPhone XS is powered by the A12 Bionic processor. iPhone 13 and iPhone 13 Mini use the Apple-designed A15 Bionic chip system. Additionally, the iPhone 15 is powered by a six-core Apple A16 Bionic processor. All above Bionic processors have common point. They are 64-bit ARM-based system on a chip (SoC) designed by Apple…
-
CVE-2024-22019: About Node.js HTTP module(21st Mar 2024)
Preface: Express framework is built on top of the Node.js HTTP module and provides us, with a clean way to write the backend. Background: The HTTP module extends two built-in classes: Net module: Provides network API for creating stream-based TCP servers or clients. Events module: Provides an event-driven architecture using EventEmitter class. Ref: Chunked transfer…
-
CVE-2024-2612: Self referencing object could have potentially led to a use-after-free (20-03-2024)
Preface: If you want the best internet browser that puts security first, not data collection, then Firefox is your best bet. Background: Smart pointers are C++ objects that not only store a pointer to a dynamically allocated resource but also manage the lifetime cycle of that resource, ensuring it is properly deallocated when no longer…
-
CVE-2024-21661: Argo CD suffers denial of service (DoS) vulnerability (18-03-2024)
Preface: What does multi threaded environment mean? Multithreading is the ability of a program or an operating system to enable more than one user at a time without requiring multiple copies of the program running on the computer. Background: Argo CD is implemented as a Kubernetes controller which continuously monitors running applications and compares the…
-
CVE-2024-28862: The Ruby One Time Password library (ROTP) Affected versions had overly permissive default permissions (18-03-2024)
Preface: In this rushed, demanding digital world, people don’t think about what the back-end platform or its design is. Therefore, vulnerability management actually relies on vendors and software developers. Background: Ruby on Rails is forming a niche as it is used by millions of websites, which includes well-known companies like Github, Shopify, Airbnb, Fiverr and…
-
CVE-2024-2193: Specter v1 variant inheriting the Specter v1 vulnerability. So called GhostRace. AMD believes the previous guidance remains applicable to mitigate this vulnerability (15-03-2024)
AMD made this announcement on March 12, 2024. Preface: Spectre variant 1 attacks take advantage of speculative execution of conditional branches, while Spectre variant 2 attacks use speculative execution of indirect branches to leak privileged memory. Background: Speculative execution improves speed by operating on multiple instructions at once—possibly in a different order than when they…
-
About CVE-2023-39368: The machine learning process requires CPUs and GPUs. Does bus lock regulator mechanism impact this area? Glad to tell, the problem fixed. (14-03-2024)
CVE-2023-39368 was published on 13th March 2024. In fact, Intel solve this problem since the end of 2020. Maybe hesitant about this design weakness. So it wasn’t announced until this month. Preface: What is Intel E core? While P cores are focused on delivering peak performance for intensive workloads, E cores ensure that the system…