-
Security Focus: CVE-2023-20857 – vmware Workspace ONE Content (3rd Mar 2023 GMT+9)
Preface: It’s always easy to forget things. Forget even your girlfriend’s birthday. So, whatever security alerts, after more than a year, become worthless. It seems nothing. Maybe not for you. But I totally agree. Background: If Android phone OS taken unofficial modified (ROOTED) . Users can install and run applications that can only be done…
-
CVE-2023-23005: Closer look of Linux kernel design weakness (memory-tier[.]c) – 2nd Mar 2023
Preface: A NUMA system is a computer platform that comprises multiple components or assemblies each of which may contain 0 or more CPUs, local memory, and/or IO buses. Background: On new design Systems servers running Linux, a set of the PCIe slots support a unique feature called 64-bit direct memory access (DMA). DMA improves I/O…
-
CVE-2023-20937 Digging a little more, is this exactly where the problem occurs. (1st Mar 2023)
Preface: Top Programming Languages for Android App Development in 2023 · Most Popular Programming Languages for Android · Kotlin · Java · C# · C++/C · Python. What is C language use-after-free. Use-After-Free (UAF) is a vulnerability related to incorrect use of dynamic memory during program operation. If after freeing a memory location, a program…
-
CVE-2023-23518 Design Weaknesses – How to lead to evasion of sandbox controls (28th Feb 2023)
Preface: Sandbox evasion techniques. Common evasion techniques include the use of specific assembly instructions, and looking for specific registry keys or file names. Background: iOS and iPadOS help ensure runtime security by using a “sandbox,” declared entitlements, and Address Space Layout Randomization (ASLR).All third-party apps are “sandboxed,” so they are restricted from accessing files stored…
-
CVE-2023-26605 ARM DevOps developers beware of this design weakness (27th Feb 2023)
Preface: When using the U-Boot UEFI implementation to boot the operating system the UEFI runtime stays in memory. Use-After-Free (UAF) is a vulnerability related to incorrect use of dynamic memory during program operation. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error…
-
All aspects of CVE-2023-0045 (24th Feb 2023)
Preface: Back to forty years ago, computer trend in mainstream is command mode. When Microsoft windows GUI born, people favour Windows OS. As time goes by, because of Microsoft system vulnerability, people said I like Linux. As of today, from time-to-time you will heard Linux Kernel vulnerability occurs. Can you change to Microsoft windows now?…
-
The vendor has addressed the issue (CVE-2023-20858). Are you interested in digging a little more? (23rd Feb 2023)
Preface: Fundamentally, so called software application system is integrated with operating system, web server/server, database and application software program. If software application program design have relationship with web server bundle application framework. Such impact not only affect a single component. Background: VMware Carbon Black Cloud Endpoint™ Standard is a next-generation antivirus (NGAV) and endpoint detection…
-
All aspects of Spectre-BHB from vulnerability to mitigation (21st Feb 2023)
Preface: Several companies are currently using Arm processors to create artificial intelligence-powered software to help make the driving experience safer. Some experts believe that artificial intelligence will affect human life. Yes it is real. The late Stephen Hawking speculated about this potential impact, but it looks like part of the process of human civilization. The…
-
CVE-2022-27672 – Addresses Cross-Thread Return Address Predictions design weakness (20th Feb 2023)
Preface: Two different methods and names, but similar in function.AMD CPUs with four cores use simultaneous multithreading to provide eight threads, and most Intel CPUs with two cores use hyper-threading to provide four threads. Background: In IBM S390 system configuration. Use the smt= and nosmt kernel parameters to control multithreading.By default, Linux in LPAR mode…
-
CVE-2023-23514: An app may be able to execute arbitrary code with kernel privileges (19th Feb 2023)
Preface: iOS 16 is the sixteenth and current major release of the iOS mobile operating system developed by Apple for its iPhone line of products. It was announced at the company’s Worldwide Developers Conference (WWDC) on June 6, 2022, as the successor to iOS 15. Background: Use-after-free is still a common bug class because the…