-
CVE‑2024‑53880: NVIDIA Triton Inference Server contains a vulnerability in the model loading API (14th Feb 2025)
Original release date: February 11, 2025 Preface: The NVIDIA Triton Inference Server API supports both HTTP/REST and GRPC protocols. These protocols allow clients to communicate with the Triton server for various tasks such as model inferencing, checking server and model health, and managing model metadata and statistics. Background: NVIDIA Triton™ Inference Server, part of the…
-
CVE-2025-23359 – NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability (11th Feb 2025)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: The NVIDIA container stack is architected…
-
CVE-2024-21924 – AMD SMM Callout Vulnerability (11th Feb 2025)
Preface: The SmmMemLib[.]c library is part of the EDK II (EFI Development Kit II) project, which is an open-source implementation of the UEFI (Unified Extensible Firmware Interface) and PI (Platform Initialization) specifications. This library is specifically used for memory management within System Management Mode (SMM). Background: The AMD Ryzen processors do not specifically use the…
-
CVE-2025-21684: A Linux GPIO (General Purpose Input/Output) driver design weakness (11th Feb 2025)
Preface: In the concept of Industry 4.0, the Internet of Things (IoT) shall be used for the development of so-called smart products. Background: The GPIO driver provides an interface for user-space applications and kernel modules to access and control the GPIO pins. It abstracts the hardware details, making it easier for developers to write code…
-
Cache-based Side-Channel Attack Against SEV (10th Feb 2024)
Originally posted by AMD 3rd Feb 2025 Preface: FIPS 186-5 removes DSA as an approved digital signature algorithm “due to a lack of use by industry and based on academic analyses that observed that implementations of DSA may be vulnerable to attacks if domain parameters are not properly generated. February 3, 2023 – NIST published…
-
CVE-2024-56161 – AMD SEV Confidential Computing Vulnerability (7th Feb 2024)
Preface: Sometimes, when a solution is misused or misconfigured, it can use this testing feature as a sword! Background: AMD SEV (Secure Encrypted Virtualization) is a hardware-based security feature designed to enhance the confidentiality and integrity of virtual machines (VMs) running on AMD EPYC processors. Here are some key points about it: Vulnerability details: Improper…
-
CVE-2025-0096 – Fix malloc buffer size (6th Feb 2025)
Original release date: February 3, 2025 Preface: The Hardware Abstraction Layer (HAL) is not outdated with Android 15. In fact, HAL continues to play a crucial role in the Android architecture. Android 15 includes improvements and updates to various HAL components, ensuring they remain relevant and effective for modern hardware and software requirements. Background: Android…
-
CVE-2025-0091: Block the content scheme intent in AccountTypePreferenceLoader (3rd Feb 2025)
Preface: As of January 2025, Android holds a global market share of 72.15%, which is a big jump from just 12% back in 2010. Background: The AccountTypePreferenceLoader is a class within the Android Settings app. It is responsible for loading and displaying account preferences, which include settings related to authenticator apps. This class plays a…
-
CVE-2025-0098 : Prevent activity token leaked to another process (3rd Feb 2025)
Preface: Android frameworks deliver an environment where you already have access to libraries, best practices, and extensive help documentation. As a matter of fact, there are well over ten android frameworks. Background: TaskFragmentOrganizerController[.]java is a part of the Android Open Source Project (AOSP). It is located in the services/core/java/com/android/server/wm directory of the Android framework. This…
-
CVE-2024-7881: To be or not to be (State Injection Into Hardware Prefetchers)?
Preface: instruction cache (I-cache) and a data cache (D-cache) This is the smallest and fastest type of cache memory. It’s embedded directly into the CPU, allowing it to operate at the same speed as the CPU. The L1 cache is typically divided into two parts: one for storing instructions (L1i) and one for storing data…