-
About CVE-2023-21633: This time not my flaw, said Android (11th July 2023)
Preface: Android Ril The RIL part of Android is mainly divided into two parts: RILJ and RILC. RILJ runs in the java part of framework->telephony, and RILC runs in the native part of the HAL layer. Background: The AP side of different manufacturers of the Android platform can be the same, but the Modem side…
-
Understanding the AI strucrure will help you defend your facilities (10th July 2023)
Preface: Python has 100s of pre-built libraries to implement various Machine Learning and Deep Learning algorithms. Background: When the word “AI” not found, Python alive everywhere in IT world. Scientist use Python programming language assists their complicated mathematics calculations. Data scientist to analyze geospatial vector data to identify a specific location. Python language is flexi…
-
CVE-2023-21250 and CVE-2023-2136: Android managed to fight it all (7th Jul 2023)
Preface: VMOS is a virtual machine app that runs on Android, which can run another Android OS as the guest operating system. Users can optionally run the guest Android VM as a rooted Android OS. The VMOS guest Android operating system has access to the Google Play Store and other Google apps. Background: It comes…
-
About CVE-2023-31248 & CVE-2023-35001: CAP_NET_ADMIN is in any user or network namespace. Does it have impact to downstream vendor? (6th July 2023)
Preface: CAP_NET_ADMIN is in any user or network namespace. Background: The “Capabilities” mechanism was introduced after the Linux kernel 2.2. If the “Capabilities” setting is incorrect,it will give attackers an opportunity to achieve privilege escalation. Linux capabilities provide a subset of the available root privileges to a process.Starting from the Linux-2.1 kernel, the concept of…
-
CVE-2023-22387 Use of Out-of-range Pointer Offset in Qualcomm IPC (4th July 2023)
Preface: Gunyah is a Type-1 hypervisor designed for strong security, performance and modularity. Independent of any high-level OS kernel, Gunyah runs in a higher CPU privilege level, and does not depend on any lower-privileged OS kernel/code for its core functionality. Background: Gunyah is a product of Qualcomm Innovation Center, Inc. Gunyah is an open-source type-1…
-
A hundred years later, communication was ready to receive phone call again.
Preface: When you read the newspaper, you will found some news, some prophet had prophecy alien may visit to our earth in 2023. Like a fiction. But coincidentally SITA also prepare for advance civilization communications. MAVEN, is an orbiter dedicated to studying Mars’ atmosphere. MAVEN launched in November 2013 and arrived at Mars in September…
-
CVE-2023-2728: Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (3rd Jul 2023)
Preface: When you know there is a vulnerability on the tool. Perhaps, your security awareness level will decrease. Maybe that makes sense, if you don’t use the tool, the risk is nullified.But sometimes it’s exceptions and coincidences. Something similar happens in the Kubernetes environment as well. Background: Ephemeral containers differ from other containers in that…
-
NVIDIA empower Artificial Intelligence competence. At the same time, vendor urge staying alert for product vulnerability (2nd Jul 2023)
-
CVE-2023-22886: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider (30th June 2023)
Preface: Airflow is a platform to programmatically author, schedule, and monitor workflows. Specifically, it is used in Machine Learning to create pipelines. Background: Apache Airflow™ is an open-source platform for developing, scheduling, and monitoring batch-oriented workflows. This open-source platform most suitable for pipelines that change slowly, are related to a specific time interval, or are pre-scheduled.…
-
CVE-2023-21220: Outdated communication methods burden modern Androids (29th June 2023)
Preface: Since the official announcement did not contain details. Perhaps the situation describe here is one of the possible reasons for encountering such vulnerabilities. Background: SMS messages are sent in plain text. Rich Communications Services (RCS) is a communication protocol that will ultimately replace MMS and SMS messages on Android devices.Android Pie (codenamed Android P during development),…