-
About CVE-2023-2124: If you manage very large Linux environments, maybe you’ve already fixed it. (16th May 2023)
Preface: For very large environments, the XFS file system that was developed by SGI for use on supercomputers is probably the best choice. Background: XFS consumes roughly twice as much CPU per metadata operation as Ext3 and Ext4 compared to Ext3 and Ext4. XFS is a 64-bit file system. XFS is the default file system…
-
About CVE-2022-40023: Do not contempt the earlier CVE record. Perhaps it will became a key point benefits to cyber criminals. (15th May 2023)
Preface: The lexer creates tokens (see TokenType and Token) from an input string. The input string is expected to be in infix notation form. The lexer can convert an infix stream into a postfix stream (Reverse Polish Notation) for further processing by a Parser. Background: Mako is a template library written in Python. It provides…
-
Mother’s Day 2023 (14th May 2023)
-
About CVE-2023-21666 – Memory Corruption in Graphics while accessing a buffer [Android Security Bulletin in 1st May 2023] (12th May 2023)
Preface: In smartphone, a GPU is similar a graphic card. Meanwhile, it’s the GRAPHICS PROCESSING UNIT which is similar to the CPU processor but instead it’s specifically dedicated for rendering 3D graphics. If your phone does not have one, then you will not be able to play any 3D games. Background: Whenever a user space…
-
About Artificial Intelligence (NVIDIA® DGX-1): Closer look at CVE‑2023‑0209 (11th May 2023)
Preface: NVIDIA DGX-1 is an integrated deep learning workstation with a large computing capacity, which can be used to run demanding deep learning workloads. It provides GPU computing power of 1 PetaFLOPS (1 quadrillion floating-point operations per second). Background: Historically, both vendors and attackers have overlooked (pre)EFI boot process (in)security; pre-EFI Initialization (PEI) boot stage…
-
CVE-2023-24941 – Windows Network File System Remote Code Execution Vulnerability. One of the possible ways to trigger the attack. (10th May 2023)
Preface: The NFS 4.1 design flaw was released in August 2019 because it only affected the Linux operating system kernel at the time. It was hard to predict, and now it is going to the Windows platform! Background: Using the NFS protocol, you can transfer files between computers running Windows and other non-Windows operating systems,…
-
CVE-2023-2513: use-after-free in ext4_xattr_set_entry (8th May 2023)
Preface: The vulnerability was fixed in Aug 2022. This is not a zero day and therefore published this month. Background: ext4 is the default file system for many Linux distributions including Debian and Ubuntu. Furthermore, ext4 is the default file system for DigitalOcean Volumes Block Storage. Also, Google has used Ext4 on Android since Android…
-
Do you know what AI thinking?But sooner or later he will become smarter than common people (8th May 2023).
Preface: The 2012 Mayans doomsday prophecy perhaps is a joke.However the poor weather havoc and unpredictable. The sudden weather change become more destructive. As a matter of fact, scientists urge that this extreme change of weather related to current environment.What’s more, the prophecy does not record how nature will change immediately. Nor does it say…
-
About CVE-2023-21511 – How local attacker to read arbitrary memory? (6th May 2023)
Preface: TEE is an area on the chipset that works like a TPM, but is not physically isolated from the rest of the chip. Background: The Trusted Execution Environment (TEE) is a secure area within the main processor. As an isolation environment, it ensures that the code and data loaded in the TEE are protected…
-
About CVE-2023-27999 (FortiADC from Fortinet): Are old vulnerabilities showing up again? (4th May 2023)
Preface: In former design weakness, attacker can smuggle commands using backticks in the “Name” field of the SAML Server configuration page. These commands are then executed as the root user of the underlying operating system.This article a speculation, since vendor do not have technical details provided in this CVE record. Background: FortiADC is an advanced…