-
While IPv6 addresses the design limitations of IPv4. The Linux kernel says it takes time to adjust. (20th June 2023)
Preface: Why do I say on behalf of the Linux kernel that it takes time to adjust. If you recall, last year (December 2022), a flaw was found in fib6_rule_suppress() that would crash the kernel. According to the RedHat knowledge base, a resolution is in the works. That’s why I mentioned. Perhaps the website not…
-
About CVE-2023-33307: When a firewall or proxy encounters a null pointer dereference flaw, which part of its functionality is most likely to be affected? (19th June 2023)
Preface: Linux supports virtual memory, that is, using a disk as an extension of RAM so that the effective size of usable memory grows correspondingly. The kernel will write the contents of a currently unused block of memory to the hard disk so that the memory can be used for another purpose. Background: Linux supports…
-
About CVE-2023-32027, CVE-2023-32026, CVE-2023-32025, CVE-2023-29356, and CVE-2023-29349. Carefully observe and speculate on design weaknesses in ODBC and OLE DB remote code execution vulnerabilities. (June 16, 2023)
Preface: Since Microsoft didn’t provide details. In this example, no dangerous code is included, just my speculation about a design weakness in the ODBC Driver for SQL Server for this week’s Patch Tuesday. Background: Switch to the new Microsoft OLE DB Driver (MSOLEDBSQL) for SQL Server or the latest Microsoft ODBC Driver for SQL Server…
-
CVE-2023-34868 – JerryScript Design weakness (15th June 2023)
Preface: Samsung said that Open Source is not only the development method also a culture and various things. Samsung always keep in mind to give back to Open Source through their activities. They are partake in the culture of sharing and collaboration with the list of projects they have released and contributed to. Background: The…
-
CVE-2023-33142 – Does it target a similar issue? (14th June 2023)
Preface: Each SharePoint site comes with default groups and permissions.There are several options when it comes to managing permissions in SharePoint.But you should be aware somethings! Background: Default Permissions in SharePoint. By default, all SharePoint sites are created with the three security groups below:• Owners – Have full control over the site• Members – Can…
-
About CVE-2023-21656, Penguin (Linux) also want to ask question to chips vendor (13th June 2023)
Preface: The Out-of-Band vulnerabilities, also known as OOB, are a series of alternative ways that an attacker uses to exploit a vulnerability that can’t be detected by a traditional request-response interaction. Background: Qualcomm Technologies offers industry leading platforms for wireless networks and products that cover the gamut of device needs. The file (wma_mgmt[.]c) contains STA/SAP/IBSS…
-
CVE-2023-27997 Lack of detail, but can we find hints? (12th June 2023)
Preface: If you need to push audio/video traffic over the tunnel DTLS can be a huge performance improvement. Background: Preferred DTLS TunnelIf enabled, FortiClient uses DTLS if it is enabled on the FortiGate and tunnel establishment is successful. If not enabled on the FortiGate or tunnel establishment does not succeed, TLS is used. DTLS tunnel…
-
About CVE-2023-21632: Flaw has been fixed. For reference only (12th June 2023)
Preface: Google (Android) and Qualcomm pioneer empower the infotainment and connectivity processors for automotive. As times goes by, when you jump to driver seat, a multifucntion dsahboard can provide functions to you.In-car entertainment or in-vehicle infotainment systems are large touch screens usually positioned on a vehicle’s dashboard or on the back of seats. Background: The…
-
CVE-2023-29403: Are you falling into this Go runtime design weakness? (9th June 2023)
Preface: Go is garbage collected instead of manual memory management which is not suitable for a kernel.Golang is useful for carrying out programming for scalable servers and large software systems. The Golang programming language was built to fill in the gaps of C++ and Java that Google came across while working with its servers and…
-
More details, CVE-2023-0266 vulnerability is widely exploited (8th June 2023)
Preface: The Advanced Linux Sound Architecture (ALSA) provides kernel driven sound card drivers.Besides the sound device drivers, ALSA also bundles a user space driven library for application developers. This enables direct (kernel) interaction with sound devices through ALSA libraries. Background: Exynos, formerly Hummingbird, is a series of ARM-based system-on-chips developed by Samsung Electronics’ System LSI…