-
About CVE-2024-36843: libmodbus v3.1.6 design weakness (3 June 2024)
Preface: Modbus is a communication protocol widely used in the field of industrial automation. It provides a standardized method for devices to communicate with each other over the network, making it an important tool for connecting and controlling various industrial equipment. Background: libmodbus supports the following functions: Vulnerability details: libmodbus v3.1.6 was discovered to contain…
-
Android Security Bulletin – May 2024 There’s a lot you can explore (9 May 2024)
Preface: Heard that Long-term support (LTS) for Linux kernels is being reduced from six to two years now. Background: Greg Kroah-Hartman is a major Linux kernel developer. As of April 2013, he is the Linux kernel maintainer for the -stable branch, the staging subsystem, USB, driver core, debugfs, kref, kobject, and the sysfs kernel subsystems,…
-
CVE-2024-4017 and CVE-2024-4018 on BeyondTrust (19-04-2024)
Preface: CyberArk most likely to be known as a leader in PAM. BeyondTrust more popular among small and medium-sized enterprises. Background: U-Series is a self-contained physical or virtual appliance that contains the operating system, the database, the BeyondTrust BeyondInsight platform, and the BeyondTrust Password Safe solution. For a BeyondInsight deployment with a local SQL Server…
-
CVE-2024-1633: Do not contempt! (19th Feb 2024)
Preface: A two-stage bootloader actually consists of two bootloaders after each other. The first being small with the sole purpose of loading the second one. The second one can then contain all the code needed for loading the kernel. Background: Secure boot is a security standard developed to help make sure that a device boots…
-
About CVE-2023-3220 An issue was discovered in the Linux kernel through 6.1-rc8 (20th June 2023)
Preface: AI Engines are built from the ground up to be software programmable and hardware adaptable. There are two distinct design flows for any developer to unleash the performance of these compute engines with the ability to compile in minutes and rapidly explore different microarchitectures.As of today, current technology are capable On-device intelligence powered by…
-
CVE-2023-34868 – JerryScript Design weakness (15th June 2023)
Preface: Samsung said that Open Source is not only the development method also a culture and various things. Samsung always keep in mind to give back to Open Source through their activities. They are partake in the culture of sharing and collaboration with the list of projects they have released and contributed to. Background: The…
-
About Qualcomm: The vulnerability of CVE-2022-40507 release to public on 06/06/2023 finally.
Preface: Double free errors occur when free() is called more than once with the same memory address as an argument. Calling free() twice on the same value can lead to memory leak. When a program calls free() twice with the same argument, the program’s memory management data structures become corrupted and could allow a malicious…
-
Cyber Défense from narrow to broad (5th Jan 2023)
Preface: Sustainability is a buzzword in the modern world in recent years. It applies to business, culture…even our education. A slogan, keep learning. Maybe it’s the Cantonese mantra, One is never too old to learn. Perhaps it also apply to cyber security protection. Background: In last twenty years, computing technology driven growth of the world.…
-
If your IoT development is based on Zigbee,perhaps Zephyr CVE will bring to your consideration. (6th Oct 2021)
Preface: Ensure that the JSON parser does not try to write a potentially unlimited number of elements into a C array of a fixed size. Background: Zephyr is a small real-time operating system (RTOS) for connected, resource-constrained and embedded devices (with an emphasis on microcontrollers) supporting multiple architectures and released under the Apache License 2.0.…
-
32-bit design limitation (0x7ffffffff). Another episode of Y2K. (23-07-2021)
Preface: Because humans have destroyed the environment. Therefore, natural disasters resemble God’s punishment. In the digital world, the situation is the same. The reason for the penalty is the design weakness of the software. Background: Perhaps the younger generation has not experienced “Y2K” technical problems because they are still children. The millennium bug is about…