-
CVE‑2024‑0082 – Design weakness of NVIDIA ChatRTX for Windows (26-03-2024)
Preface: Unlike OpenAI’s ChatGPT, Chat with RTX doesn’t remember the context of prompts. Asking Chat with RTX to give examples of fishes in one prompt and then asking for a description of “the fishes” in the next prompt will result in a blank – users will need to spell out everything explicitly. Background: Chat with…
-
CVE-2024-2885: Use after free in Dawn in Google Chrome (26th Mar 2024)
Preface: WebGPU is a JavaScript API provided by a web browser that enables webpage scripts to efficiently utilize a device’s graphics processing unit (GPU). Google has enabled WebGPU support by default in Chrome 121, the latest version of its Chrome browser. Background: WebGPU sees physical GPU hardware as GPUAdapters. It provides a connection to an…
-
To be new or it was former: Rowhammer Attacks on AMD Zen-Based Platforms. So called ZenHammer (25-03-2024)
Preface: It is possible to trigger Rowhammer bit flips on DDR4 devices on AMD Zen 2 and Zen 3 systems despite deployed TRR mitigations, said researchers at ETH Zurich. Background: When high-energy charged particles pass through the crystal lattice of a silicon wafer, their charges can interfere with the electrons within the lattice itself and…
-
CVE-2024-29059 – [.]NET Framework Information Disclosure Vulnerability (24th Mar 2024)
Preface: Microsoft did not tell the details of the vulnerability! What happened to the .NET Framework? Can we guess what happened? [.]NET is a platform framework. Currently, there are two types: the [.]NET Framework exclusive to the Windows platform and the cross-platform .NET Core. Background: The [.]NET Framework works with applications developed in C#, F#,…
-
What are the security updates for 17.4.1? Apple, as always, won’t tell you the details of the vulnerability! (22-03-2024)
Preface: iPhone XS is powered by the A12 Bionic processor. iPhone 13 and iPhone 13 Mini use the Apple-designed A15 Bionic chip system. Additionally, the iPhone 15 is powered by a six-core Apple A16 Bionic processor. All above Bionic processors have common point. They are 64-bit ARM-based system on a chip (SoC) designed by Apple…
-
CVE-2024-22019: About Node.js HTTP module(21st Mar 2024)
Preface: Express framework is built on top of the Node.js HTTP module and provides us, with a clean way to write the backend. Background: The HTTP module extends two built-in classes: Net module: Provides network API for creating stream-based TCP servers or clients. Events module: Provides an event-driven architecture using EventEmitter class. Ref: Chunked transfer…
-
CVE-2024-2612: Self referencing object could have potentially led to a use-after-free (20-03-2024)
Preface: If you want the best internet browser that puts security first, not data collection, then Firefox is your best bet. Background: Smart pointers are C++ objects that not only store a pointer to a dynamically allocated resource but also manage the lifetime cycle of that resource, ensuring it is properly deallocated when no longer…
-
CVE-2024-21661: Argo CD suffers denial of service (DoS) vulnerability (18-03-2024)
Preface: What does multi threaded environment mean? Multithreading is the ability of a program or an operating system to enable more than one user at a time without requiring multiple copies of the program running on the computer. Background: Argo CD is implemented as a Kubernetes controller which continuously monitors running applications and compares the…
-
CVE-2024-28862: The Ruby One Time Password library (ROTP) Affected versions had overly permissive default permissions (18-03-2024)
Preface: In this rushed, demanding digital world, people don’t think about what the back-end platform or its design is. Therefore, vulnerability management actually relies on vendors and software developers. Background: Ruby on Rails is forming a niche as it is used by millions of websites, which includes well-known companies like Github, Shopify, Airbnb, Fiverr and…
-
CVE-2024-2193: Specter v1 variant inheriting the Specter v1 vulnerability. So called GhostRace. AMD believes the previous guidance remains applicable to mitigate this vulnerability (15-03-2024)
AMD made this announcement on March 12, 2024. Preface: Spectre variant 1 attacks take advantage of speculative execution of conditional branches, while Spectre variant 2 attacks use speculative execution of indirect branches to leak privileged memory. Background: Speculative execution improves speed by operating on multiple instructions at once—possibly in a different order than when they…