-
CVE-2025-62161: About Youki, a container runtime written in Rust (10th Nov 2025)
Preface: Amazon, Google, Microsoft, Apple, Cloudflare, Coursera, Discord, Dropbox, and Figma are among the large companies employing Rust for various purposes, including cloud infrastructure, operating system components, web services, and low-level security components. Youki is gaining increasing attention as a container runtime, especially in the Rust ecosystem, but it has not yet achieved the widespread…
-
About CVE-2025-47365: Qualcomm integrated with automotive platform (7th Nov 2025)
Published: 11/03/2025 Preface: GM’s Ultra Cruise system is supposed to be a more capable iteration of its Super Cruise ADAS that was first introduced in 2017. To dig into the weeds a bit, the Ultra Cruise compute, which is about the size of two laptops stacked together, is made up of two Snapdragon SA8540P SoCs…
-
Security Bulletin: About NVIDIA RunAI – CVE-2025-33176 (6th Nov 2025)
Preface: NVIDIA Run:ai is a Kubernetes-native platform for managing and optimizing AI workloads, acquired by NVIDIA in 2024. It provides dynamic orchestration for GPU resources, supporting flexible resource allocation to improve resource utilization and accelerate the AI development lifecycle in hybrid, on-premises, and cloud environments. Prior to its acquisition by NVIDIA in December 2024, Run:ai…
-
CVE-2025-47353: About Automotive Software platform based on QNX (5th Nov 2025)
Preface: An automotive cockpit is the driver’s compartment, integrating all the controls and information displays needed to operate a vehicle, including the steering wheel, dashboard, instruments, and central displays. Background: To install QNX on a Qualcomm SA8775P chip, you will need the specific QNX Board Support Package (BSP) for that platform, as it contains the…
-
TEE.fail: Another perspective on how intercepting DDR5 memory bus can compromise a trusted execution environment. (4th Nov 2025)
Preface: The recent research, released in a paper titled “TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition”, does not change Intel’s previous out of scope statement for these types of physical attacks. Background: Intel SGX protects memory by creating encrypted “enclaves,” which are isolated, private regions within an application’s address space. These enclaves…
-
Worth considering: The orbital plane of 3I/ATLAS is unusually precise with the Sun. (3rd Nov 2025)
Worth considering: The orbital plane of 3I/ATLAS is unusually precise with the Sun. Preface: Researchers at the University of California, Riverside conducted an experiment that found that if a terrestrial planet existed between Mars and Jupiter, it could push Earth out of the solar system and destroy life on it. Ref: The full research paper…
-
CVE-2025-58185: improper handling of ASN.1 DER encoding (3rd Nov 2025)
Preface: Is ASN-1 still in use? ASN-1 is used to define a large number of protocols. Its most widespread applications remain in telecommunications, cryptography, and biometrics. ASN.1 is used in protocols like TLS and LDAP/Active Directory because it provides a language and platform independent way to define data structures, making it a standard for interoperability.…
-
About Chrome (V8 Bug 452296415 with CVE-2025-12036): updated to 141.0.7390.122/.123 for Windows and Mac and 141.0.7390.122 for Linux. (31-10-2025)
Preface: Type confusion is a vulnerability where a program accesses a resource using an incompatible type, leading to unexpected behavior or memory corruption. This often occurs when a program misinterprets the type of data being used, potentially leading to the execution of the wrong code or the disclosure of sensitive information. This can happen due…
-
In-depth discussion of the basic knowledge of CAN BUS preventive control (30th Oct 2025)
Preface: Is the CAN bus still in use? While the CAN protocol was originally designed for road vehicles and is still primarily used there, the vehicle bus format has found its way into aircraft, aerospace, and rail systems. Background: CAN bus significantly reduces traditional cable connections by allowing multiple electronic control units (ECUs) to communicate…
-
About Bouncy Castle cryptography – CVE‐2025‐12194: The real fix is reachability fencing, which ensures timely resource disposal regardless of thread type. (28-10-2025)
Published: 2025-10-24 Preface: The Australian government has utilized Bouncy Castle cryptography APIs. Specifically, the Australian Government’s AUSKey project, which was a system for securely accessing government online services, used the Bouncy Castle libraries as its basis for Java cryptography. Bouncy Castle is a widely-used open-source cryptographic API available for Java and C#, developed and maintained…