-
CVE-2024-57258 – Integer overflows in memory allocation in Das U-Boot (19-02-2025)
Preface: U-Boot is both a first-stage and second-stage bootloader. It is loaded by the system’s ROM (e.g. on-chip ROM of an ARM CPU) from a supported boot device, such as an SD card, SATA drive, NOR flash (e.g. using SPI or I²C), or NAND flash. Background: Das U-Boot is an open source, primary boot loader…
-
nodejs: GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) 17-02-2025
Preface: If artificial intelligence could create the world. Do you know how his creation differs from Genesis? Artificial intelligence focuses on efficiency, and everything needs to be fast. But God is concerned with the balance of nature. Therefore, the development of everything is not rapid. Background: HTTP/2 enables full request and response multiplexing. In practice,…
-
Cache-based Side-Channel Attack Against SEV (18th Feb 2024)
Originally posted by AMD 3rd Feb 2025 Updated Acknowledgement – 2025-02-17 Preface: FIPS 186-5 removes DSA as an approved digital signature algorithm “due to a lack of use by industry and based on academic analyses that observed that implementations of DSA may be vulnerable to attacks if domain parameters are not properly generated. February 3,…
-
CVE-2024-0112 – about NVIDIA Jetson AGX Orin™ and NVIDIA IGX Orin software (17th Feb 2025)
The original security advisory was issued on February 11, 2025. Preface: NVIDIA IGX Orin software is used by a variety of organizations, particularly those in industrial and medical environments. This platform is designed to support AI applications at the edge, providing high performance, advanced functional safety, and security. Some specific use cases include: The platform’s…
-
CVE‑2024‑53880: NVIDIA Triton Inference Server contains a vulnerability in the model loading API (14th Feb 2025)
Original release date: February 11, 2025 Preface: The NVIDIA Triton Inference Server API supports both HTTP/REST and GRPC protocols. These protocols allow clients to communicate with the Triton server for various tasks such as model inferencing, checking server and model health, and managing model metadata and statistics. Background: NVIDIA Triton™ Inference Server, part of the…
-
CVE-2025-23359 – NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability (11th Feb 2025)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: The NVIDIA container stack is architected…
-
CVE-2024-21924 – AMD SMM Callout Vulnerability (11th Feb 2025)
Preface: The SmmMemLib[.]c library is part of the EDK II (EFI Development Kit II) project, which is an open-source implementation of the UEFI (Unified Extensible Firmware Interface) and PI (Platform Initialization) specifications. This library is specifically used for memory management within System Management Mode (SMM). Background: The AMD Ryzen processors do not specifically use the…
-
CVE-2025-21684: A Linux GPIO (General Purpose Input/Output) driver design weakness (11th Feb 2025)
Preface: In the concept of Industry 4.0, the Internet of Things (IoT) shall be used for the development of so-called smart products. Background: The GPIO driver provides an interface for user-space applications and kernel modules to access and control the GPIO pins. It abstracts the hardware details, making it easier for developers to write code…
-
Cache-based Side-Channel Attack Against SEV (10th Feb 2024)
Originally posted by AMD 3rd Feb 2025 Preface: FIPS 186-5 removes DSA as an approved digital signature algorithm “due to a lack of use by industry and based on academic analyses that observed that implementations of DSA may be vulnerable to attacks if domain parameters are not properly generated. February 3, 2023 – NIST published…
-
CVE-2024-56161 – AMD SEV Confidential Computing Vulnerability (7th Feb 2024)
Preface: Sometimes, when a solution is misused or misconfigured, it can use this testing feature as a sword! Background: AMD SEV (Secure Encrypted Virtualization) is a hardware-based security feature designed to enhance the confidentiality and integrity of virtual machines (VMs) running on AMD EPYC processors. Here are some key points about it: Vulnerability details: Improper…