-
CVE-2023-4622: It should patch by processor vendor or SUSE? (14th Dec 2023)
Preface: Unix domain sockets and network sockets have different security characteristics. In general, Unix domain sockets are considered to be more secure than network sockets, as they are not exposed to the network and are only accessible to processes on the same machine. Background: A Unix domain socket aka UDS or IPC socket (inter-process communication…
-
About CVE-2023-40078: The OPUS a2dp on the Android platform has a design flaw that may lead paired device escalation of privilege (14th Dec 2023)
Preface: A2DP is a protocol supported on most Bluetooth Audio devices. Opus is open source , OPUS a2dp being introduced in Android 13. Background: In Bluetooth, there is a possibility of code-execution due to a use after free. This could lead to paired device escalation of privilege in the privileged Bluetooth process with no additional…
-
CVE-2023-42914 – An app may be able to break out of its sandbox (13th Dec 2023)
Preface: One action Apple has taken over the past few years is to harden the Safari WebContent (or “renderer”) process sandbox attack surface on iOS, most recently by removing the ability for WebContent to be exploited directly to the GPU process. Background: App Sandbox provides protection to system resources and user data by limiting your…
-
CVE-2023-6679 – About The Linux kernel dpll subsystem (11th Dec 2023)
Preface: Null pointer dereference vulnerability can be exploited by hackers to maliciously crash a process to cause a denial of service. Can null pointer cause memory leak? This memory leak is caused by overwriting a pointer to allocated memory with either another valid pointer, or with a NULL pointer. Background: PLL – Phase Locked Loop…
-
ABout KubeVirt: Announcement ID – SUSE-SU-2023:4693-1 (Rating: important ) 10th Dec 2023
Preface: Many enterprises have implemented Kubernetes and containers, and most also run virtual machines. This environment therefore increases operational complexity as well as time and infrastructure costs. Background: OpenStack, libvirt, Kubernetes, Vagrant, and boot2docker are the most popular alternatives and competitors to KubeVirt. What is the difference between Kubernetes and KubeVirt? Scheduling, networking and storage…
-
About CVE-2023-40088: When similar design flaws arise, perhaps you question the effectiveness of your security architecture? (7th Dec 2023)
Preface: Bluetooth is now a regular part of your mobile experience. It covers everything from audio to wireless headphones and speakers, pairing game controllers and keyboards, network connections, and even the occasional file transfer over the air. Background: What is Bluetooth adapter in Android? The BluetoothAdapter lets you perform fundamental Bluetooth tasks, such as initiate…
-
For AI world in future, NVIDIA has developed a Secure Deployment Considerations Guide address to Triton Inference Server (6th Dec 2023)
Preface: Artificial intelligence (AI) is growing like lightning. As a I.T computer user. Maybe we enjoy the benefits of smartphone apps features empowered by AI. As a matter of fact, we do no care or without knowledge what is AI back-end operations and architecture. For example, when you buy a steamed bun at the store,…
-
CVE-2023-40082 whether caused by a previous vulnerability? (4th Dec 2023)
Preface: Das U-Boot (subtitled “the Universal Boot Loader” and often shortened to U-Boot. Background: Das U-Boot is an open-source boot loader used in embedded devices to perform various low-level hardware initialization tasks and boot the device’s operating system kernel. It is available for a number of computer architectures, including 68k, ARM, Blackfin, MicroBlaze, MIPS, Nios,…
-
About ARM security advisory: CVE-2023-5427 – improper GPU memory processing operations to gain access to already freed memory (4th Dec 2023)
Preface: If you need memory to live beyond the life of the current function, you need to allocate it on the heap with malloc and manage it yourself. Background: The Android and Linux version of the Mali GPUs Device Driver provide low-level access to the Mali GPUs that are part of the Open Source Mali 5th…
-
About CVE-2023-42917: Cybercriminals may exploit design flaws in iOS versions prior to 16.7.1 (1st Dec 2023)
Preface: Some people say that if AI (artificial intelligence) involves software development in the future, the occurrence of vulnerabilities may be reduced. On the other hand, experts speculate that the product development cycle may take more time. If artificial intelligence is also involved in business decisions, when they calculate the risk portfolio of products and…