-
CVE-2024-5660: This issue could allow a modified, untrusted guest operating system to compromise the host in certain hypervisor environments. (11 Dec 2024)
Preface: NVIDIA Jetson™ is the world’s leading embedded AI computing platform with an integrated Arm CPU. Background: The owning translation regime uses its address translation table data to determine the properties of the trace data transactions written to system memory. CPUECTLR_EL1 is a 64-bit register, and is part of the 64-bit registers functional group. This…
-
[CVE-2024-47586] SAP NetWeaver AS ABAP NULL Pointer Dereference (3504390) – 11 Dec 2024
Preface: In computing, an oops is a serious but non-fatal error in the Linux kernel. An oops may precede a kernel panic, but it may also allow continued operation with compromised reliability. Background: The Internet Communication Manager ensures that communication between the SAP System (SAP NetWeaver Application Server) and the outside world via HTTP, HTTPS…
-
CVE-2024-53143 – fsnotify: Fix ordering of iput() and watched_objects decrement (10 Dec 2024)
Preface: The Go language is also developed on fsnotify, but the file extension is fsnotify[.]go. fsnotify is a Go library to provide cross-platform filesystem notifications on Windows, Linux, macOS, BSD, and illumos. Go 1.17 or newer is . Background: In Linux, fsnotify is actually implemented based on the inotify system call. inotify is a subsystem of…
-
CVE-2024-43767: Size overflow when allocating SkMask data (8th Dec 2024)
Preface: Yes, it is possible to develop an Android app using C++. While Java and Kotlin are the recommended languages for Android development. Many memory manipulation functions in C and C++ do not perform bounds checking and can easily overwrite the allocated bounds of the buffers they operate upon. Background: Skia Graphics Library (SGL) is…
-
CVE-2024-38920: Use-after-free issue related to the humble version of Open Robotics Robot Operating System 2 (ROS2) and Nav2 (6 Dec 2024)
Preface: Use-after-free (UAF) vulnerabilities are a class of software flaws that involve using a memory resident object after it has been freed. UAF vulnerabilities most commonly occur when a C++ object that was allocated on the heap is accessed after it is deleted, but stack-allocated objects can also be used after a free. Background: The…
-
About Qualcomm CVE-2024-4304 – Stack-based Buffer Overflow in Performance (5 Dec 2024)
Preface: Primitive types such as `int`, `double`, `char`, and `boolean` are stored directly in stack memory. Each time you declare a primitive variable, the JVM allocates a specific size of memory for it. Background: Returns the available average/minimum GPU headroom in percentage for last ‘duration’ seconds. The get_gpu_headroom() API is used by applications to get…
-
About Qualcomm – CVE-2024-33056 Buffer Over-read in MProc (4th Dec 2024)
Preface: What is a buffer over-read? The opposite of a buffer overflow is a buffer overread. In this case, the program requests data from outside the buffer. Because data read from outside the buffer is irrelevant to the program, it may cause the program to crash or behave unexpectedly. Background: Qualcomm SoC chips are divided…
-
About Qualcomm – CVE-2024-33044 (3 Dec 2024)
Preface: The Qualcomm Hypervisor provides a modern virtualization framework that allows multiple operating systems to run independently and concurrently, delivering high performance. The Qualcomm Type 1 Hypervisor facilitates the hosting of multiple trusted execution environments for secure use cases. Background: On some Qualcomm platforms, the hypervisor emulates more than 128 SMR (Stream Matching Register) groups.…
-
About CVE-2024-43703 from Imaginetech (2Dec 2024)
Preface: Preface: Imagination Technologies Group Limited is a British semiconductor and software design company owned by Canyon Bridge Capital Partners, a private equity fund based in Beijing that is ultimately owned by the Chinese government. With its global headquarters in Kings Langley, England, its primary business is in the design of PowerVR mobile graphics processors…
-
CVE-2023-52922 : Fix Use-After-Free in bcm_proc_show() (29 Nov 2024)
Preface: A zero-day exploit targeting a use-after-free (UAF) vulnerability in the Linux Kernel. Staying Alert! Slab–use–after–free vulnerabilities occur when memory that’s been previously freed is accessed again, often leading to unpredictable behavior or system crashes. KernelAddressSANitizer (KASAN) is a dynamic memory error detector designed to find out-of-bound and use–after–free bugs. Background: The Controller Area Network…