-
CVE-2025-0096 – Fix malloc buffer size (6th Feb 2025)
Original release date: February 3, 2025 Preface: The Hardware Abstraction Layer (HAL) is not outdated with Android 15. In fact, HAL continues to play a crucial role in the Android architecture. Android 15 includes improvements and updates to various HAL components, ensuring they remain relevant and effective for modern hardware and software requirements. Background: Android…
-
CVE-2025-0091: Block the content scheme intent in AccountTypePreferenceLoader (3rd Feb 2025)
Preface: As of January 2025, Android holds a global market share of 72.15%, which is a big jump from just 12% back in 2010. Background: The AccountTypePreferenceLoader is a class within the Android Settings app. It is responsible for loading and displaying account preferences, which include settings related to authenticator apps. This class plays a…
-
CVE-2025-0098 : Prevent activity token leaked to another process (3rd Feb 2025)
Preface: Android frameworks deliver an environment where you already have access to libraries, best practices, and extensive help documentation. As a matter of fact, there are well over ten android frameworks. Background: TaskFragmentOrganizerController[.]java is a part of the Android Open Source Project (AOSP). It is located in the services/core/java/com/android/server/wm directory of the Android framework. This…
-
CVE-2024-7881: To be or not to be (State Injection Into Hardware Prefetchers)?
Preface: instruction cache (I-cache) and a data cache (D-cache) This is the smallest and fastest type of cache memory. It’s embedded directly into the CPU, allowing it to operate at the same speed as the CPU. The L1 cache is typically divided into two parts: one for storing instructions (L1i) and one for storing data…
-
CVE-2024-0140 : NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue (24th Jan 2025)
Preface: RAPIDS™, part of NVIDIA CUDA-X, is an open-source suite of GPU-accelerated data science and AI libraries with APIs that match the most popular open-source data tools. It accelerates performance by orders of magnitude, at scale, across data pipelines. Background: RAPIDS is an open-source suite of software libraries and frameworks developed by NVIDIA to accelerate…
-
It is speculated that CVE-2025-0612 and CVE-2025-0611 are related to the rendering engine! (23-01-2025)
Preface: Humans have integrated smartphones (IoT) into their daily lives due to habit formation. Suddenly one day, the browsers of more than 20% of the people on the planet stopped working for half a day. Maybe you’ll see long queues outside the hospital! It similar as an intangible control to you. Go to AI age/century,…
-
Node[.]js for WebSockets: It is useful and powerful, but a cost you should pay. The design weakness of Fortinet awaken his competitors (22-01-2025)
Preface: Mars is very cold, with an average temperature of -62 degrees Celsius. Therefore, human living environments need to be designed to withstand extreme cold. Fortunately, however, these temperatures are not beyond our control. In fact, there are cities on Earth where temperatures have reached such low levels. Maybe, this is what Elon Musk meant…
-
CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (21-01-2025)
Preface: Is io_uring secure? io_uring has produced many security problems. Google has found it necessary to either completely forego io_uring or severely limit its use to trusted code. Background: io_uring is an asynchronous I/O interface for the Linux kernel. An io_uring is a pair of ring buffers in shared memory that are used as queues…
-
CVE‑2024‑0146: A design weakness in the Virtual GPU Manager, where a malicious guest could cause memory corruption. (20-1-2025)
CVE‑2024‑0146: A design weakness in the Virtual GPU Manager, where a malicious guest could cause memory corruption. (20-1-2025) Preface: In Kernel mode, the executing code has complete and unrestricted access to the underlying hardware. It can execute any CPU instruction and reference any memory address. Kernel mode is generally reserved for the lowest-level, most trusted…
-
CVE-2024-53869: NVIDIA Unified Memory driver for Linux design weakness. A successful exploit of this vulnerability might lead to information disclosure. (16th Jan 2025)
Preface: RAM and Unified Memory are essentially the same thing. Unified Memory is just RAM Built-in CPU chips. It’s unified with the CPU. So 128GB of RAM is adequate to 128GB of unified Memory. Background: Nvidia designs graphics processing units (GPUs) for the gaming and professional markets, as well as system on a chip units…