-
CVE-2024-50311: A denial of service (DoS) vulnerability was found in OpenShift (23rd Oct 2024)
Preface: Typical REST APIs exhibit a few issues that we can solve with GraphQL. One of the most prominent is over fetching, which occurs when a client fetches too much data from the server. When OpenShift Console is fetching a lot of data, it leverages chunked responses introduced in k8s 1.9. Fetching is split into…
-
CVE-2024-49861: bpf (Fix helper writes to read-only maps) – 22 Oct 2024
Preface: BPF is a highly flexible and efficient virtual machine-like construct in the Linux kernel allowing to execute bytecode at various hook points in a safe manner. It is used in a number of Linux kernel subsystems, most prominently networking, tracing and security (e.g. sandboxing). Background: BPF does not define itself by only providing its…
-
AMD’s response to the research paper that their technical details do not demonstrate any new security vulnerabilities in AMD prefetchers. (18 Oct 2024)
Preface: A hardware prefetcher is a data prefetching technique implemented as a hardware component in a processor, aimed at improving performance by fetching data before it is actually needed. Let’s take a closer look at prefetching. And speculate what kind of prefetching will approach this discussion. Background: A research paper titled ‘ShadowLoad: Injecting State into…
-
VMware HCX resolves CVE-2024-38814 vulnerability (18-10-2024)
Preface: T-SQL is widely used in SQL Server environments. For instance, communication between an app and a SQL Server instance involves sending T-SQL statements to the server. Background: VMware HCX streamlines migration, helps rebalance workloads, helps protect data, and optimizes disaster recovery processes for both on-premises data centers and cloud servers. HCX Connector or Cloud…
-
Through the patched CVE-2024-0132 fixing Docker vulnerability (CVE-2024-9348) 17th Oct 2024
Preface: When artificial intelligence gains enough intelligence, do you know what it will say if it knows that software or applications developed by humans have vulnerabilities? He would say “Fxxx”! Background: Docker Engine is the fundamental containerization engine that runs on servers and manages containers, while Docker Desktop is a developer-focused tool that includes Docker…
-
CVE-2024-0129 – Path traversal issue discovered in NVIDIA NeMo (16-Oct-2024)
Preface: If successful, a path traversal attack may result in the following risks: Unauthorized data access: An attacker can gain access to sensitive files, such as configuration files, system files, or source code, which may include Credentials, application code and data, and sensitive operating system files. Background: NVIDIA NeMo™ is an end-to-end platform for developing…
-
About AMD-SB-7025 and AMD-SB-3013: Technical research papers provided to AMD (15-Oct-2024)
Preface: Examples of side channel attacks include timing attacks, cache-based attacks, and network traffic analysis. Mitigating side channel attacks involves implementing secure coding practices, employing cryptographic algorithms resistant to side channels, and minimizing timing differences. Background: Cache side channel attacks can infer the secret information processed by the victim by measuring the victim’s cache usage…
-
CVE-2024-45184: Design weakness found in Exynos, a system-on-chip based on Samsung’s ARM development (October 14, 2024)
Preface: USAT (USIM Application Toolkit) technology is based on the original passive operation mode of the SIM card and adds the new active operation capability of the SIM card, which allows applications and services in the SIM card to actively interact with mobile terminals. Background: The USAT (USIM Application Toolkit) is a standardized set of…
-
CVE-2024-47670: ocfs2 – add bounds checking (10-10-2024)
Preface: OCFS2 is a file system. It allows users to store and retrieve data. The data is stored in files that are organized in a hierarchical directory tree. It is a POSIX compliant file system that supports the standard interfaces and the behavioral semantics as spelled out by that specification. Background: OCFS2 is a useful…
-
Is Qualcomm CVE-2024-23369 the same as CVE-2022-33278? (9th Oct 2024)
Preface: Security patches can be divided into 2 categories — HLOS (High Level Operating System) and NON-HLOS. The first category is for patches concerning the Android system itself and the Linux kernel, and the other is about code running at much lower levels. Background: The software image running on the main processor is termed as…