Cyber security technical information

Author: admin

  • CVE-2025-23247: NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary (28-5-2025)

    Preface: ROCm open source software platform is AMD’s core strategy. This platform supports deep learning frameworks such as PyTorch 2.0 and TensorFlow. Nvidia’s CUDA cores are indispensable for training and deploying neural networks and deep learning models, taking advantage of their parallel processing capabilities. To put that into perspective, a dozen Nvidia H100 GPUs can…

  • CVE-2025-35003: Apache NuttX RTOS Bluetooth Stack (HCI and UART components) 27-5-2025

    Preface: During the Dahe period of Emperor Wenzong of the Tang Dynasty (827-835 AD), there was a scholar named Zheng Renben(鄭仁本), his cousin and his friend Wang Xiucai(王秀才) wandering in Zhongyue Songshan Mountain(中嶽嵩山) and got lost in a deep valley. It was getting dark at this time, and the two were very scared. As they…

  • CVE-2025-37992: About NULL pointer dereference in net_sched (27-05-2025)

    Preface: Linux powers large parts of the Internet, cloud infrastructure, and supercomputers. But it is difficult to determine the exact number of Linux systems in the world. This appears to be a technology trend that includes AI system infrastructure. Background: In Linux, a “qdisc” stands for queueing discipline. It’s a core component of the Linux…

  • When artificial intelligence encounters a geomagnetic storm (26-05-2025)

    Preface: About fifteen years ago, extreme climate sounded the alarm for humanity. But we haven’t woken up yet. As we enter 2025, extreme weather is raging. Are we awake now? Background: A coronal mass ejection (CME) can induce a geomagnetic storm when it interacts with Earth’s magnetosphere. CMEs are large clouds of plasma and magnetic…

  • Point of view – IOLeak – CPU Side Channel Attacks  23-05-2025

    Preface: Hertzbleedis about inferring secrets from timing differencescaused by how CPUs adjust their frequency under load. Background: The Hertzbleed vulnerability does not specifically target the L2 cache of AMD CPUs. Instead, it exploits a broader mechanism related to dynamic frequency scaling — a feature used by modern CPUs (including AMD Zen 2 and Zen 3)…

  • CVE-2025-27558: FragAttacks against mesh networks (21-05-2025)

    Preface: A Mesh Basic Service Set (MBSS) is a self-contained wireless network created by a group of interconnected mesh stations (STAs). Each mesh station can act as both an access point and a mesh node, enabling communication and data sharing within the mesh network. The MBSS uses a “mesh profile” to define the network’s characteristics,…

  • CVE-2025-37991 – PA-RISC: Fix double SIGFPE crash (21-05-2025)

    Preface: In the Linux Kernel, SIGFPE (Signal Floating-Point Exception) indicates a computational error, specifically related to floating-point arithmetic or integer arithmetic errors. This signal is triggered by events like floating-point overflow, underflow, or division by zero. While named “Floating-Point Exception,” it actually covers a broader range of arithmetic errors. Background: What triggers SIGFPE? How it…

  • CVE-2025-47935 and CVE-2025-47944: About Multer design weakness (19-05-2025)

    Preface: In a typical web application, there are three layers of middleware: Web server middleware. Application server middleware and Database middleware. A common request for file upload applications. For example: uploading user avatars, attaching documents or handling multimedia content. Multer is a node.js middleware for handling multipart/form-data, which is primarily used for uploading files. Background:…

  • Part 1: Spectre-v2 Domain Isolation, does it fight against variants? (19-05-2025)

    Preface: In computer architecture, a branch predictor is a digital circuit that tries to guess which way a branch will go before this is known definitively. Background: Although the Spectre v2 vulnerability has been protected by domain isolation technologies such as IBPB, eIBRS and BHI_NO, which prevent attackers from training the indirect branch predictor with…

  • CVE-2025-47436: Heap-based Buffer Overflow vulnerability in Apache ORC. (15-5-2025)

    Preface: Traditional row-based formats for data normalization have several limitations: Complex Queries: Normalization often requires joining multiple tables to retrieve data, which can make queries more complex and slower. Maintenance Challenges: Maintaining a highly normalized database can be more difficult, as changes to the schema may require updates to multiple tables. Background: Apache ORC (Optimized…