-
About CVE-2023-3006 – Specter-BHB on arm update on end of May 2023 (1st June 2023)
Preface: Speculate that this CVE is custom for Ampere Computing. Ampere Computing is an ARM architecture licensee and develops its own server microprocessors. Background: Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to…
-
CVE-2023-32067 – c-ares is vulnerable to denial of service (30th May 2023)
Preface: c-ares is a C language implementation of asynchronous request DNS. When using c-ares, you usually only need to reference the ares.h header file, and the related header files of the library are included. Background: For some asynchronous DNS requests, Node[.]js uses a C library called c-ares.So called Async DNS – This feature bypasses the…
-
About CVE-2023-32695 – A patch has been released in socket[.]io-parser version 4.2.3.
Preface: In technical aspect, a Socket[.]IO server can sustain 10,000 concurrent connections. Therefore you can build a chat experience and using Socket[.]IO as your realtime communication solution. But if you want chat users to receive push notifications when they’re not actively using the app, Socket[.]IO can’t help, as it relies on a persistent socket connection.…
-
CVE-2022-33302 – Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.(25th May 2023)
Preface: Perhaps you feeling that it’s not follow best practice when it is a zero-day matter. Seems this CVE was late published. The fact is that the impact look serious. So before vendor resolve the problem. Vendor do not intent disclose to public. But problem resolved now. Background: The User Identity Module may contain information…
-
CVE-2023-32413 A race condition occurred in process state handling. It is very common in OS systems, be it Linux or Microsoft Windows. (23rd May 2023)
Preface: A race condition vulnerability typically occurs when your application has access to the same shared data and attempts to change variables within it simultaneously. Applications can become vulnerable to race conditions if they interact with other applications that use parallel processing or multiple threads. Background: A process describes an individual running instance of a program.…
-
About CVE-2023-21666 – Memory Corruption in Graphics while accessing a buffer [Android Security Bulletin in 1st May 2023] (12th May 2023)
Preface: In smartphone, a GPU is similar a graphic card. Meanwhile, it’s the GRAPHICS PROCESSING UNIT which is similar to the CPU processor but instead it’s specifically dedicated for rendering 3D graphics. If your phone does not have one, then you will not be able to play any 3D games. Background: Whenever a user space…
-
What is the value of the Trusted Execution Environment (TEE) ? (20th JAN 2023)
Preface: Some said, found malware lets cybercriminal remotely manipulate your Android. Background: The full name of TEE is trusted execution environment, which is an area on the CPU of mobile devices (smart phones, tablets, smart TVs). The role of this area is to provide a more secure space for data and code execution, and to…
-
CVE-2022-47630 – See whether your android can skip this vulnerability? Perhaps it can. (16th Jan 2023)
Preface: Why configure Secure Boot? This type of hardware restriction protects the operating system from rootkits and other attacks that may not be detected by antivirus software. Background: Secure Boot is the process where the operating system boot images and code are authenticated against the hardware before they are authorized to be used in the…
-
Retrospect a simple bug in smartphones software development in 2022 (28th Dec 2022)
Denial of service from the big world to the small world Preface: Perhaps the historical information can be enrich our knowledge base. Even through you think the information I posted by today not very useful. However this is so called database. See whether you are still interested in this matter today? Background: The Flutter framework…
-
CVE-2022-46702 Apple iOS/iPadOS up to 16.1.2 GPU Drivers memory corruption (23rd Dec 2022)
Preface: When an external GPU is connected to the iOS system. Refer to attached diagram , it will perform compute simulations on that external GPU. And thus graphics rendering on a built-in GPU. According the current GPU design. Do you think is there desugn weakness happen here. For instance, memory access control and access permission.…