-
About CVE-2023-40088: When similar design flaws arise, perhaps you question the effectiveness of your security architecture? (7th Dec 2023)
Preface: Bluetooth is now a regular part of your mobile experience. It covers everything from audio to wireless headphones and speakers, pairing game controllers and keyboards, network connections, and even the occasional file transfer over the air. Background: What is Bluetooth adapter in Android? The BluetoothAdapter lets you perform fundamental Bluetooth tasks, such as initiate…
-
CVE-2023-40082 whether caused by a previous vulnerability? (4th Dec 2023)
Preface: Das U-Boot (subtitled “the Universal Boot Loader” and often shortened to U-Boot. Background: Das U-Boot is an open-source boot loader used in embedded devices to perform various low-level hardware initialization tasks and boot the device’s operating system kernel. It is available for a number of computer architectures, including 68k, ARM, Blackfin, MicroBlaze, MIPS, Nios,…
-
About ARM security advisory: CVE-2023-5427 – improper GPU memory processing operations to gain access to already freed memory (4th Dec 2023)
Preface: If you need memory to live beyond the life of the current function, you need to allocate it on the heap with malloc and manage it yourself. Background: The Android and Linux version of the Mali GPUs Device Driver provide low-level access to the Mali GPUs that are part of the Open Source Mali 5th…
-
About CVE-2023-42917: Cybercriminals may exploit design flaws in iOS versions prior to 16.7.1 (1st Dec 2023)
Preface: Some people say that if AI (artificial intelligence) involves software development in the future, the occurrence of vulnerabilities may be reduced. On the other hand, experts speculate that the product development cycle may take more time. If artificial intelligence is also involved in business decisions, when they calculate the risk portfolio of products and…
-
CVE-2023-46589: About TOMCAT , HTTP Trailer Header request smuggling (28th Nov 2023)
-
CVE-2023-33936: Vendor response to side-channel attacks targeting some Arm v8 CPUs (28th Nov 2023)
Preface: Prefetching means that monitors the memory access pattern of the running program and tries to predict what data the program will access next and prefetches that data. The Spatial Memory Streaming, a practical on-chip hardware technique that identifies code- correlated spatial access patterns and streams predicted blocks to the primary cache ahead of demand…
-
Get closer CVE-2023-20592: Related to certain models of AMD CPUs (27th Nov 2023)
Preface: Since we have virtual machines, memory management is more difficult to manage. Maybe you disagree. Yes, in theory, the effective memory type is determined by the PAT entry value and the MTRR value. Background: The hypervisor (HV) virtualizes real physical memory so an unmodified OS (such as Linux or Android) that is running in…
-
CVE-2023-48105: Weakness in buffer boundary checks in wasm loader (23rd Nov 2023)
Preface: Decentralized AI is an approach to AI where the data and models are distributed across multiple devices, rather than being centralized in a single location. Such design benefits to AI infrastructure avoiding denial of service attack and let unknown technical matter occurs during this period. Background: Internet Computing aims to extend the capabilities of…
-
Do not contempt CVE-2023-6238: kernel: nvme: memory corruption via unprivileged user passthrough (22nd Nov 2023)
Preface: High-performance computing is a method of processing large amounts of data and performing complex calculations at high speed. HPC is well suited for AI, which uses large data sets and complex models. HPC and AI combined have use cases in the following areas: Predictive Analytics. Physics and Modeling. IO-Heavy HPC Computing: Requires systems that…
-
About CVE-2023-48223: Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for all public key types. (20th Nov 2023)
Preface: How is JavaScript different from Java? · Java is an OOP programming language, and Javascript is an OOP description language. Background: JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and…