-
CVE-2025-27029 – Buffer Over-read in WLAN HAL (3rd Jun 2025)
Preface: Google has been transitioning HALs from HIDL to AIDL since Android 11, and by Android 13 and 14, most major HALs—including Wi-Fi (WLAN), Audio, Bluetooth, and Telephony—have adopted AIDL as the standard interface definition language. Background: In Android, defining and managing buffers in the WAN HAL (Wide Area Network Hardware Abstraction Layer) isn’t a…
-
CVE-2025-21479: Incorrect Authorization in Graphics (2nd June 2025)
Preface: Snapdragon chipsets, which are a type of System-on-a-Chip (SoC), often include memory components, such as RAM (Random Access Memory) and ROM (Read-Only Memory), within the chip itself. This integrated approach allows for faster and more efficient data processing within the device. Background: In Qualcomm Snapdragon SoCs, the Adreno GPU is responsible for graphics and…
-
CVE-2025-1763: About GitLab EE (2nd Jun 2025)
Preface: The computer industry favors GitLab because it provides a comprehensive, integrated software development platform that covers everything from planning and code management to continuous integration and deployment. This “full operation and maintenance” approach simplifies the software development life cycle and promotes collaboration between different teams. GitLab’s open source nature, free basic version, and strong…
-
The relationship between humans and water in the Old Testament (30-05-2025)
Preface: Humans need water to survive. Water is a basic need for life and an important component of the human body. On the other hand, Massive floods have occurred multiple times in Earth’s history, some of which are significant geological events that have shaped the landscape and influenced the course of life on Earth. Examples…
-
Deserialization of Untrusted Data vulnerability in Apache InLong (29-05-2025)
Preface: Apache InLong can be a valuable component in machine learning (ML) and artificial intelligence (AI) workflows, particularly in the data engineering and streaming data pipeline stages. Background: Apache InLong is a one-stop massive data integration framework that provides automatic, secure, reliable and high-performance data transmission capabilities. It also supports batch and streaming, making it…
-
CVE-2025-23247: NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary (28-5-2025)
Preface: ROCm open source software platform is AMD’s core strategy. This platform supports deep learning frameworks such as PyTorch 2.0 and TensorFlow. Nvidia’s CUDA cores are indispensable for training and deploying neural networks and deep learning models, taking advantage of their parallel processing capabilities. To put that into perspective, a dozen Nvidia H100 GPUs can…
-
CVE-2025-35003: Apache NuttX RTOS Bluetooth Stack (HCI and UART components) 27-5-2025
Preface: During the Dahe period of Emperor Wenzong of the Tang Dynasty (827-835 AD), there was a scholar named Zheng Renben(鄭仁本), his cousin and his friend Wang Xiucai(王秀才) wandering in Zhongyue Songshan Mountain(中嶽嵩山) and got lost in a deep valley. It was getting dark at this time, and the two were very scared. As they…
-
CVE-2025-37992: About NULL pointer dereference in net_sched (27-05-2025)
Preface: Linux powers large parts of the Internet, cloud infrastructure, and supercomputers. But it is difficult to determine the exact number of Linux systems in the world. This appears to be a technology trend that includes AI system infrastructure. Background: In Linux, a “qdisc” stands for queueing discipline. It’s a core component of the Linux…
-
When artificial intelligence encounters a geomagnetic storm (26-05-2025)
Preface: About fifteen years ago, extreme climate sounded the alarm for humanity. But we haven’t woken up yet. As we enter 2025, extreme weather is raging. Are we awake now? Background: A coronal mass ejection (CME) can induce a geomagnetic storm when it interacts with Earth’s magnetosphere. CMEs are large clouds of plasma and magnetic…
-
Point of view – IOLeak – CPU Side Channel Attacks 23-05-2025
Preface: Hertzbleedis about inferring secrets from timing differencescaused by how CPUs adjust their frequency under load. Background: The Hertzbleed vulnerability does not specifically target the L2 cache of AMD CPUs. Instead, it exploits a broader mechanism related to dynamic frequency scaling — a feature used by modern CPUs (including AMD Zen 2 and Zen 3)…