-
CVE-2024-23354 Memory corruption when the IOCTL call is interrupted by a signal. (24May 2024)
Originally published on May 6, 2024 Preface: The Snapdragon 8 Gen 2 Mobile Platform defines a new premium standard for connected computing. Intelligently engineered with groundbreaking AI across the board, this AI marvel enables truly extraordinary experiences. Background: A vertex buffer object (VBO) is an OpenGL feature that provides methods for uploading vertex data (position,…
-
CVE-2024-22274: vCenter design weakness. Does it similar to this way? (23 May 2024)
Preface: In computer security, arbitrary code execution (ACE) is an attacker’s ability to run any commands or code of the attacker’s choice on a target machine or in a target process. An arbitrary code execution vulnerability is a security flaw in software or hardware allowing arbitrary code execution. Background: vCenter Server is the centralized management…
-
CVE-2024-36008: The impact may be widespread but has been resolved. Linux, you did a great job. (21May 2024)
Preface: Syzbot has begun to report kernel findings to LKML in 2017. Syzbot is a continuous kernel build / fuzz / report aggregation system. Background: Linux has two mechanisms for setting routes, one is fib, and the other is routing generated by dynamic. fib uses route (man 8 route) to specify a static route table.…
-
Is AMD Instinct™ MI300X affected by CVE-2023-4969 (GPU memory leak). AMD has the answer. Official announcement on May 7, 2024.
This article was published on May 21, 2024. Preface: When I see the vulnerability it shows the date far away from now. Sometimes I lose interest. Maybe I’m missing a major technical detail. AMD officially released CVE-2023-4869 on March 7, 2024. It happened to wake me up! Although today is May 21, 2024, it seems…
-
CVE-2024-23664: CW:601 was fixed by Fortinet (20th May 2024)
Initial publication: 14th May 2024 Preface: What happens if a website uses a user-supplied URL in a URL fragment to redirect the logged-in user to the requested page? Background: CWE 601 – An open redirect vulnerability occurs when an application allows the user to control redirects or forward to another URL. If the application does…
-
CVE-2024-21792: Time-of-check Time-of-use race conditionin Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: Intel Neural Compressor is an open…
-
CVE-2024-22476: Improper input validation in some Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: Intel Neural Compressor performs model optimization to reduce the model size and increase the speed of deep learning inference for deployment on CPUs or GPUs. Background: Intel Neural Compressor is an open source Python* library that performs model compression techniques such as quantization, pruning, and knowledge distillation across multiple deep learning frameworks including TensorFlow*,…
-
About CVE-2024-22252: Recently, Broadcom VMware has often repeated previous CVE posts. Maybe it’s a new company policy or necessary? (14-May-2024)
Official last updated on May 8, 2024. An early advisory for this vulnerability was issued on March 5, 2024. Preface: If you recall, this design flaw was discovered in April 2021. Has it been fixed? Or it is vendors fine-tuned their vulnerability management strategies? Background: A Transfer Ring is an array of Transfer Request Blocks…
-
CVE-2024-21474: Qualcomm did not disclose technical details. Could this situation cause this problem? (6th May 2024)
Preface: The Qualcomm Snapdragon X65 5G Modem is the baseband chipset used in the iPad Pro (11-inch) (4th generation), iPad Pro (12.9-inch) (6th generation), iPhone 14, iPhone 14 Plus, iPhone 14 Pro and iPhone 14 Pro Max. Background: A power management integrated circuit (PMIC) is used to manage power on an electronic devices or in…
-
About VMware Enhanced Authentication Plug-in (EAP): VMware urges customers to remain alert for CVE-2024-22245 and CVE-2024-22250. (May 7, 2024)
This announcement original published on 20th Feb 2024 Preface: When two components have problems in the same place. If vendor did not specify the details in clear. In this circumstances, the design weakness looks the same. Background: The Enhanced Authentication Plugin (EAP) is an extra software package that doesn’t come pre-installed. Administrators need to install…