-
CVE-2024-11863, CVE-2024-11864 and CVE-2024-9413: Three different CVEs were discovered that expose the System Control Processor (SCP) to attack threats. (16th Jan 2025)
Preface: SCMI is a message driven interface between an SCMI agent (client) and an SCMI host (server) Background: SCP Firmware provides a software reference implementation for the System Control Processor (SCP) and Manageability Control Processor (MCP) components found in several Arm Compute Sub-Systems. Power Control System Architecture (PCSA) defines the concept of a System Control…
-
About CVE-2024-0135, CVE-2024-0136 & CVE-2024-0137 – NVIDIA Container Toolkit and NVIDIA GPU Operator contains an improper isolation vulnerability (13th Jan 2025)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: The NVIDIA container stack is architected…
-
CVE-2024-43064: Permissions, Privileges, and Access Controls issue in Automotive OS Platform (14-01-2025)
Preface: QNX is also used in devices where failure is not an option. Fault tolerance was and is the biggest priority for the QNX operating system. A great example from the past is that the SpaceX Falcon rockets used the QNX Real-Time Operating System. Background: An SMMU performs a task like that of an MMU…
-
CVE-2024-45550 – Improper Validation of Array Index in DSP Services (13th Jan 2025)
Preface: IOCTL handlers allow users to communicate with the driver via the ioctl syscall. This is a prime attack surface because the driver is going to be handling userland-provided data within kernel space. Background: dxgkrnl is a driver for Hyper-V virtual compute devices, such as vGPU devices, which are projected to a Linux virtual machine…
-
CVE-2024-43704: improper GPU system calls to gain access to the graphics buffers of a parent process. (10th Jan 2025)
Preface: PowerVR is a division of Imagination Technologies (formerly VideoLogic) that develops hardware and software for 2D and 3D rendering, and for video encoding, decoding, associated image processing and DirectX, OpenGL ES, OpenVG, and OpenCL acceleration. Background: Imagination maintains DDKs for Android, Linux and Windows operating systems, ensuring they have access to the latest APIs and popular extensions. To…
-
CVE-2024-20154: Stack overflow in Modem (9th Jan 2024)
Preface: Vulnerability findings appear to have changed compared to five years ago. As a matter of fact, the trend of open source concept driven the a lot of details visible, a bunch of vulnerabilities have accumulated in 2024, and the Android security advisory on January 2025 shows you what’s the actual status. Manufacturers will have…
-
CVE-2024-21464 – msm: ipa3: adding a preventive check for holb stats (8th JAN 2025)
Preface: Vulnerability findings appear to have changed compared to five years ago. As a matter of fact, the trend of open source concept driven the a lot of details visible, a bunch of vulnerabilities have accumulated in 2024, and the Android security advisory on January 2025 shows you what’s the actual status. Manufacturers will have…
-
An Android security bulletin was published on January 6, 2025, which disclosed multiple vulnerabilities but did not provide details (7th Jan 2025)
Preface: Vulnerability findings appear to have changed compared to five years ago. As a matter of fact, the trend of open source concept driven the a lot of details visible, a bunch of vulnerabilities have accumulated in 2024, and the Android security advisory on January 2025 shows you what’s the actual status. Manufacturers will have…
-
CVE-2025-0222 A vulnerability was found in IObit Protected Folder up to 13.6.0.5. (6th Jan 2025)
Preface: Dereferencing just means accessing the memory value at a given address. So when you have a pointer to something, to dereference the pointer means to read or write the data that the pointer points to. Background: IObit Uninstaller is one of the free software uninstallers for Windows thanks to a batch uninstall feature, an…
-
Machine learning: From basics to GPU-related INT8( 3rd Jan 2025)
Preface: If a living thing wants to survive, his life involve competition. For example, hunting and defense. During this process, he started learning. that’s the nature of it. Remember this is the basic principle. When non-human beings on Earth can enter into the learning process. He will be humanity’s rival. In fact, who will rule…