All posts by admin

Network (Protocol, Topology & Standard), Potential Risk of CVE

CVE-2024-52811 : Fix heap buffer overflow writing not validated ACK to qlog (25 Nov 2024)

Leave a comment

Preface: Most of Google’s traffic already goes through QUIC. Several other well-known companies have also begun developing their own implementations, such as Microsoft, Facebook, CloudFlare, Mozilla, Apple, Akamai,…etc

Background: By combining the best of TCP and UDP, along with encryption and better handling of modern network conditions, QUIC is set to become the foundation of faster, more secure, and more reliable internet experiences. ngtcp2 project is an effort to implement RFC9000 QUIC protocol.

Vulnerability details: The ngtcp2 project is an effort to implement IETF QUIC protocol in C. In affected versions acks are not validated before being written to the qlog leading to a buffer overflow.

In `ngtcp2_conn::conn_recv_pkt` for an ACK, there was new logic that got added to skip `conn_recv_ack` if an ack has already been processed in the payload. However, this causes us to also skip `ngtcp2_pkt_validate_ack`. The ack which was skipped still got written to qlog.

The bug occurs in `ngtcp2_qlog::write_ack_frame`. It is now possible to reach this code with an invalid ack, suppose `largest_ack=0` and `first_ack_range=15`. Subtracting `largest_ack – first_ack_range` will lead to an integer underflow which is 20 chars long. However, the ngtcp2 qlog code assumes the number written is a signed integer and only accounts for 19 characters of overhead (see `NGTCP2_QLOG_ACK_FRAME_RANGE_OVERHEAD`).

Therefore, we overwrite the buffer causing a heap overflow. This is high priority and could potentially impact many users if they enable qlog.

Remark: qlog is disabled by default. Due to its overhead, it is most likely used for debugging purpose, but the actual use is unknown.

Remedy: ngtcp2 v1.9.1 fixes the bug and users are advised to upgrade. Users unable to upgrade should not turn on qlog.

Official announcement: Please see the link below for details – https://nvd.nist.gov/vuln/detail/CVE-2024-52811

AI and ML, Potential Risk of CVE

CVE-2024-11393 – Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (25 Nov 2024)

Leave a comment

Preface: What is the difference between Hugging Face and transformers?

Transformers is a library that contains various state-of-the-art machine learning models, as well as a Trainer API which can be used to train models. Huggingface_hub is a library to programmatically integrate with the hub.

Backgound: Masks are often used in segmentation tasks, where they provide a precise way to isolate the object of interest for further processing or analysis.

MaskFormer is based on the DETR architecture, which uses a transformer decoder to predict masks for each object in an image. MaskFormer has been shown to be effective for both semantic segmentation and panoptic segmentation. However, it has not been as successful for instance segmentation.

Vulnerability details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of model files.

Official announcement: Please see the link below for details – https://nvd.nist.gov/vuln/detail/CVE-2024-11393

IoT, Potential Risk of CVE

CVE-2024-10382 – a code execution vulnerability in the Car App Android Jetpack Library (22 Nov 2024)

Leave a comment

Preface: Android Auto is a platform running on the user’s phone, projecting the Android Auto user experience to a compatible in-vehicle infotainment system over a USB connection. Android Auto supports apps designed for in-vehicle use.

Background: The Android for Cars App Library lets you bring your navigation, point of interest (POI), and internet of things (IOT) apps to the car.

Android[.]car[.]app

Interfaces

OnDoneCallback – A host-side interface for handling success and failure scenarios on calls to the client.

OnRequestPermissionsListener – A listener with the results from a permissions request.

OnScreenResultListener – A listener to provide the result set by a Screen.

SurfaceCallback – A callback for changes on the SurfaceContainer and its attributes.

Vulnerability details: There exists a code execution vulnerability in the Car App Android Jetpack Library. In the CarAppService desrialization logic is used that allows for arbitrary java classes to be constructed. In combination with other gadgets, this can lead to arbitrary code execution. An attacker needs to have an app on a victims Android device that uses the CarAppService Class and the victim would need to install a malicious app alongside it. We recommend upgrading the library past version 1.7.0-beta02

Official announcement: Please see the link below for details – https://nvd.nist.gov/vuln/detail/cve-2024-10382

AI and ML, Potential Risk of CVE

CVE-2024-0122: About design weakness in NVIDIA Delegated Licensing Service (21nd Nov 2024)

Leave a comment

Preface: NVIDIA Delegated License Service (DLS) is a component of NVIDIA License System that serves licenses to licensed clients. A DLS instance is hosted on-premises at a location that is accessible from your private network, such as inside your data center.

Background: For deployment in a virtual machine, the Delegated License Server (DLS) component of the NVIDIA License System is supplied as a virtual appliance. The virtual appliance must be installed on a supported hypervisor software release.

The following hypervisor software releases are supported:

Citrix Hypervisor 8.2

Linux Kernel-based Virtual Machine (KVM) hypervisors with one of the following QEMU releases:

QEMU 4.2.0

QEMU 2.12.0 (qemu-kvm-2.12.0-64.el8.2.27782638)

Microsoft Windows Server with Hyper-V 2019 Datacenter edition

Red Hat Enterprise Linux Kernel-based Virtual Machine (KVM) 9.2, 9.1, 9.0, and 8.8

Red Hat Virtualization 4.3

Ubuntu Hypervisor 22.04

VMware vSphere Hypervisor (ESXi) ) 8.0.3, 8.0.2, 8.0.1, 8.0, 7.0.3, 7.0.2, and 7.0.1

Supported Container Orchestration Platforms

For deployment on a supported container orchestration platform, the Delegated License Server (DLS) component of the NVIDIA License System is supplied as a containerized software image.

The following container orchestration platform releases are supported:

Docker 27.1.1 with Docker Compose 2.29.1

Kubernetes 1.23.8

Red Hat OpenShift Container Platform 4.10.67 with Kubernetes 1.23.17

Podman 4.4.2 with Podman Compose 1.0.7

VMware Tanzu Application Platform 1.1 with Kubernetes 1.23.6

Vulnerability details: CVE-2024-0122 – NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure.

Official announcement: Please refer to the link for details

https://nvidia.custhelp.com/app/answers/detail/a_id/5570

AI and ML, Potential Risk of CVE

CVE-2024-0138: NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component.

Leave a comment

(Updated 11/18/2024 04:12 PM)

Preface: Nvidia acquires Bright Computing, maker of Bright Cluster Manager software that controls the configuration of clustered HPC systems, including Nvidia’s own DGX servers and HGX systems manufactured by OEMs and ODMs, as well as clusters from other manufacturers.

Background: NVIDIA Base Command Manager provides cluster management software for streamlining cluster provisioning, workload management, and infrastructure monitoring. It provides all the tools for deploying and managing an AI data center.

Note: Base Command Manager 10 is licensed on a per-GPU base. This differs from the node-base licensing model of Bright Cluster Manager. Customers with active support subscriptions using Bright Cluster Manager 9.2 and earlier can upgrade to Base Command Manager 10 by exchanging their current licenses for GPU-based Base Command Manager 10 licenses at no cost.

Vulnerability details: CVE-2024-0138

NVIDIA Base Command Manager contains a missing authentication vulnerability in the CMDaemon component. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.      

Official announcement: For more details please see link – https://nvidia.custhelp.com/app/answers/detail/a_id/5595

Potential Risk of CVE

CVE-2024-52316 : Unchecked Error Condition vulnerability in Apache Tomcat (19th Nov 2024)

Leave a comment

Preface: Apache Tomcat is one of the top technologies in Java developers’ tech stacks—and for good reason. According to the 2024 Java Developer Productivity Report, 36% of Java developers use Apache Tomcat as their application server. 

Background: Apache Tomcat (called “Tomcat” for short) is a free and open-source implementation of the Jakarta Servlet, Jakarta Expression Language, and WebSocket technologies. Jakarta is one of their project under which they have developed tomcat servlet container. Jakarta Authentication defines a general low-level SPI for authentication mechanisms, which are controllers that interact with a caller and a container’s environment to obtain the caller’s credentials, validate these, and pass an authenticated identity (such as name and groups) to the container.

Vulnerability details: Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception during the authentication process without explicitly setting an HTTP status to indicate failure, the authentication may not fail, allowing the user to bypass the authentication process. There are no known Jakarta Authentication components that behave in this way.

Affected version : This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M26, from 10.1.0-M1 through 10.1.30, from 9.0.0-M1 through 9.0.95. Users are recommended to upgrade to version 11.0.0, 10.1.31 or 9.0.96, which fix the issue.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2024-52316

IoT, Potential Risk of CVE

CVE-2024-9413 – A vulnerability has been discovered in SCP-Firmware (18 Nov 2024)

Leave a comment

Preface: The Cortex-M3 processor is specifically developed for high-performance, low-cost platforms for a broad range of devices including microcontrollers, automotive body systems, industrial control systems and wireless networking and sensors.

Background: SCP Firmware provides a software reference implementation for the System Control Processor (SCP) and Manageability Control Processor (MCP) components found in several Arm Compute Sub-Systems. Functionality.

Description. Initialization. Initialization of the system to enable application core boot.

Power Control System Architecture (PCSA) defines the concept of a System Control Processor (SCP), a specialized processor that abstracts power and system management tasks from the application processor.

Vulnerability details: The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application Processor (AP) to cause a buffer overflow in System Control Processor (SCP) firmware.

Official announcement: For detail, please refer to link –

https://nvd.nist.gov/vuln/detail/CVE-2024-9413

AI and ML, Potential Risk of CVE

CVE-2024-28028: Improper input validation in some Intel® Neural Compressor software (15-11-2024)

Leave a comment

Preface: If you talk to God, what is the difference between human and artificial intelligence? Maybe God will say that humans and A.I are incomparable. And both cannot live together in the same place.

Background: Intel Neural Compressor performs model optimization to reduce the model size and increase the speed of deep learning inference for deployment on CPUs or GPUs.

Intel Neural Compressor aims to provide popular model compression techniques such as quantization, pruning (sparsity), distillation, and neural architecture search on mainstream frameworks such as TensorFlow, PyTorch, ONNX Runtime, and MXNet, as well as Intel extensions such as Intel Extension for TensorFlow and Intel Extension for PyTorch.

Vulnerability details:

CVEID: CVE-2024-28028

Improper input validation in some Intel(R) Neural Compressor software before version v3.0 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.

Affected Products: Intel® Neural Compressor software before version 3.0.

Official announcement: For detail, please refer to link – https://nvd.nist.gov/vuln/detail/CVE-2024-28028

Cell Phone (iPhone, Android, windows mobile), Potential Risk of CVE

CVE-2024-38424 Use After Free in GPS (14-12-2024)

Leave a comment

Preface: There are four global satellite navigation systems, currently GPS (United States), GLONASS (Russian Federation), Beidou (China) and Galileo (European Union).

Background: Android Opensource is called HLOS. Qualcomm’s proprietary one is called non-HLOS.

The Android on Snapdragon architecture is built to allow for common feature adoption across devices with Snapdragon. It represents the software features and functionalities available on Qualcomm® reference devices and provided to OEMs for design into their Android mobile devices and tablets.

Global Navigation Satellite System ( GNSS ) refers to any satellite constellation that provides global positioning, navigation, and timing services. Several GNSS are currently available: BeiDou (China) , Galileo (EU), GPS (USA) and GLONASS (Russia). On Oct 2022, Rx Networks, Inc., a GNSS data services company, announced the availability of TruePoint.io precise location services on Qualcomm’s Snapdragon 8 Gen 1 and Snapdragon 888 5G Mobile Platforms.

Vulnerability details: Memory corruption during GNSS HAL process initialization.

Technology Area: GPS HLOS Driver

CWE-416: Use After Free

Official announcement: Please refer to the official announcement for details – https://nvd.nist.gov/vuln/detail/CVE-2024-38424

AI and ML, Potential Risk of CVE

About AMD Ryzen™ AI Software: CVE-2024-21974, CVE-2024-21975 and CVE- 2024-21976 (13Nov 2024)

Leave a comment

Preface: A pointer is a variable that stores the memory address of another variable. Unlike typical variables that hold data like numbers or characters, pointers hold the location of where data is stored in your computer’s memory. By knowing the address, pointers can access & manipulate the data at that memory location.

Background:

1.Install NPU Drivers

2.Download the NPU driver installation package NPU Driver

3.Install the NPU drivers by following these steps:

4.Extract the downloaded “NPU_RAI1.2.zip” zip file.

5.Open a terminal in administrator mode and execute the[[.]\npu_sw_installer[.]exe] exe file.

6.Ensure that NPU MCDM driver (Version:32.0.201.204, Date:7/26/2024) is correctly installed by opening Device Manager -> Neural processors -> NPU Compute Accelerator Device.

Vulnerability details:

CVE-2024-21974 Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.

CVE-2024-21975 Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.

CVE-2024-21976 Improper input validation in the NPU driver could allow an attacker to supply a specially crafted pointer potentially leading to arbitrary code execution.

Official announcement: Please refer to the official announcement for details – https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7017.html