-
CVE-2024-36347: Improper signature verification in AMD CPU ROM microcode patch loader (11th Mar 2025)
Originally published on March 5, 2025 Preface: The microcode patch loader in the CPU’s ROM (Read-Only Memory) is responsible for loading these updates into the CPU during the boot process. This ensures that the CPU runs the latest microcode, which can include important security and functionality improvements Background: The System Management Mode (SMM) execution environment…
-
CVE-2025-22412: Fix more memory-unsafe logging (10th Mar 2025)
Preface: In smartphones, the System on Chip (SoC), such as those made by Qualcomm, integrates various components including the CPU, GPU, and memory. The embedded OS and applications run on this SoC, utilizing its built-in memory (RAM) for processing tasks.The flash storage (often referred to as flashdisk) in smartphones is primarily used for storing persistent…
-
CVE-2024-0141: NVIDIA Hopper HGX for 8-GPU contains a vulnerability in GPU vBIOS (10th Mar2025)
Last official update on February 28, 2025 at 3:28 PM Preface: Hopper PPCIe is limited to HGX 8-way systems, where the eight GPUs and four NVSwitches are passed through to one VM. Other topologies are not supported. Background: The GPU vBIOS can communicate through IOCTL (Input/Output Control) calls. IOCTL is a system call for device-specific…
-
CVE-2024-0114: NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller HMC (7 th March 2025)
Preface: NVIDIA collaborates with Supermicro for their server solutions, including the use of Supermicro’s BMC (Baseboard Management Controller) in certain systems. Supermicro provides a range of server solutions optimized for NVIDIA’s platforms. Background: The NVIDIA Hopper HGX for 8 GPUs has several standout features: High Performance: It hosts eight H100 Tensor Core GPUs, which are…
-
2024-53022: Memory corruption may occur during communication between primary and guest VM (6th Mar 2025)
Preface: QNX hypervisors are available in two variants: QNX Hypervisor and QNX Hypervisor for Safety. The QNX Hypervisor variant (QH), which includes QNX Hypervisor 8.0, is not a safety-certified product. It must not be used in a safety-related production system. If you are building a safety-related system, you must use the QNX Hypervisor for Safety…
-
CVE-2025-22413: (ANDROID (KVM (arm64)) Don’t run a protected VCPU if it isn’t runnable! (5 March 2025)
Preface: The protected Kernel-based Virtual Machine (pKVM) is an advanced virtualization technology built on top of the Linux Kernel-based Virtual Machine (KVM). It is designed to enhance security and isolation for virtual machines (VMs) running on Android devices. Key points about pKVM: Enhanced Security: pKVM restricts access to the payloads running in guest VMs marked…
-
CVE-2025-0078: Ensuring that the identity of the requesting service is included and verified during inter-process communication (4th Mar 2025)
Preface: The Gospel of Matthew 24:37 As it was in the days of Noah, so it will be at the coming of the Son of Man. For in the days before the flood, people were eating and drinking,..etc Background: In Android, the ServiceManager is a key component in the Binder IPC (Inter-Process Communication) mechanism. It…
-
CVE-2020-24658: A year-old vulnerability is still hiding in embedded systems (3rd Mar 2025)
Preface: Many programmers continue to use Arm Compiler 5 for several reasons: Developers who have been using Arm Compiler 5 for years are familiar with its quirks and features, making it easier for them to continue using it rather than learning a new toolchain. Furthermore, Arm Compiler 5 supports older ARM architectures that may not…
-
PAGE PREFETCHER ATTACK – AMD ID: AMD-SB-7040 (28-2-2025)
Preface: Page prefetching is a technique used to improve performance by preloading data into the cache before it’s actually needed. However, the implementation and presence of a page prefetcher can vary depending on the CPU architecture and design. Background: A page prefetcher attack is a type of side-channel attack that exploits the page prefetching mechanism…
-
CVE-2024-36353: CROSS-PROCESS GPU MEMORY DISCLOSURE (27-02-2025)
Preface: Regarding its use in HPC clusters, the Radeon PRO V710 is indeed suitable. It is supported by AMD’s ROCm platform, which is optimized for HPC and AI workloads. Additionally, it is used in Azure’s NVads V710 v5-series virtual machines, which are designed for GPU-accelerated applications, including HPC. Background: The global memory of the AMD…