-
CVE-2023-20583 is Low Risk. But what is a software-based power side channel on an AMD CPU? (2nd Aug 2023)
Preface: AMD explain this design flaw. Do you have any queries? Background: Ryzen is multi-core X86 (64) microprocessors. AMD made its own as an extension of the x86 instruction set. In some AMD processors using frequency scaling . CPU Frequency Scaling is a feature that enables the operating system to scale the CPU frequency up…
-
About CVE-2023-31116: Design weakness of Samsung Exynos Modem 5123 and 5300 (1st Aug 2023)
Preface: RCS enables more dynamic and secure conversations than SMS and MMS. It allows users to share high-resolution photos and videos up to 100MB in size. Background: About one year ago, Google’s next-generation flagship Pixel 7 series appears in the Android 13 developer preview, using Samsung’s baseband chip, model g5300b. RCS is the successor to…
-
Important: CVE-2023-24540 burdens the OpenShift API for Data Protection (OADP), resulting in a security vulnerability (31st Jul 2023)
Preface: Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set “\t\n\f\r\u0020\u2028\u2029” in JavaScript contexts that also contain actions may not be properly sanitized during execution (CVE-2023-24540) Background: OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume…
-
Time-honored brands face ordeal. Caused by CVE-2023-35078! (26th Jul 2023)
Preface: The company was founded in 2007. MobileIron, he is early pioneer in mobile security and management for smartphones and tablet computers, such as iPhone, iPad, Android…etc. Background: Core supports a number of application program interfaces (APIs): The MobileIron V2 API is a RESTful API you use to send HTTPS requests to get data from…
-
About Apple Neural Engine (CVE-2023-38136) 26th Jul 2023
Preface: We can only use the Neural Engine through Core ML. Core ML is the foundation for domain-specific frameworks and functionality. You can build and train a model with the Create ML app bundled with Xcode. Models trained using Create ML are in the Core ML model format and are ready to use in your…
-
CVE-2023-20593: AMD patched the Zenbleed vulnerability that could allow attackers to exploit several Ryzon and EPYC processors (25th Jul 2023)
Preface: The x86-64-AMD Ryzen Zen 2 CPU is a microprocessor architecture developed by AMD. It is based on the Zen microarchitecture, which was first introduced in 2017. The Zen 2 architecture features a number of improvements over the previous generation, including higher performance, lower power consumption, and support for new features such as PCIe 4.0…
-
About CVE-2023-2430: The io_uring is a completely new approach to I/O API. Linux Kernel is super again. (24th Jul 2023)
Preface: How does IO uring work? It works by creating two circular buffers, called “queue rings”, for storage of submission and completion of I/O requests, respectively. For storage devices, these are called the submission queue (SQ) and completion queue (CQ). Background: io_uring can handle various I/O related requests. for example: How io_uring is implemented in…
-
CVE-2023-22052 – Vulnerability in the Java VM component of Oracle Database Server (19th Jul 2023)
Preface: In Oracle Database, you can store and execute Java code directly in the database using Oracle Java Virtual Machine (OJVM). You can take your Java code, put it into the database and execute it. Background: You can extend a relational database’s storage, indexing, and searching capabilities to include semistructured and nonstructured data (including Web…
-
Regarding CVE-2023-3519: Design flaw under specified conditions, said Citrix (July 19, 2023)
Background: Use Citrix Gateway with StoreFront to provide secure remote access for users outside the corporate network and Citrix ADC to provide load balancing. *Citrix StoreFront is an enterprise application store that provides an interface for users to access XenDesktop and XenApp virtual desktops and applications remotely. How do I access Citrix StoreFront? On the…
-
The Base Score 3.7 (Integrity impacts). Why Oracle concerning about CVE-2023-21949? (18th Jul 2023)
Preface: What is Kerberos authentication in database? Kerberos is a protocol for authenticating service requests between trusted hosts across an untrusted network, such as the internet. Kerberos support is built in to all major computer operating systems, including Microsoft Windows, Apple macOS, FreeBSD and Linux. Background: The Oracle Advanced Networking Option is an optional product…