-
CVE-2025-23359 – NVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability (11th Feb 2025)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: The NVIDIA container stack is architected…
-
CVE-2024-21924 – AMD SMM Callout Vulnerability (11th Feb 2025)
Preface: The SmmMemLib[.]c library is part of the EDK II (EFI Development Kit II) project, which is an open-source implementation of the UEFI (Unified Extensible Firmware Interface) and PI (Platform Initialization) specifications. This library is specifically used for memory management within System Management Mode (SMM). Background: The AMD Ryzen processors do not specifically use the…
-
CVE-2025-21684: A Linux GPIO (General Purpose Input/Output) driver design weakness (11th Feb 2025)
Preface: In the concept of Industry 4.0, the Internet of Things (IoT) shall be used for the development of so-called smart products. Background: The GPIO driver provides an interface for user-space applications and kernel modules to access and control the GPIO pins. It abstracts the hardware details, making it easier for developers to write code…
-
Cache-based Side-Channel Attack Against SEV (10th Feb 2024)
Originally posted by AMD 3rd Feb 2025 Preface: FIPS 186-5 removes DSA as an approved digital signature algorithm “due to a lack of use by industry and based on academic analyses that observed that implementations of DSA may be vulnerable to attacks if domain parameters are not properly generated. February 3, 2023 – NIST published…
-
CVE-2024-56161 – AMD SEV Confidential Computing Vulnerability (7th Feb 2024)
Preface: Sometimes, when a solution is misused or misconfigured, it can use this testing feature as a sword! Background: AMD SEV (Secure Encrypted Virtualization) is a hardware-based security feature designed to enhance the confidentiality and integrity of virtual machines (VMs) running on AMD EPYC processors. Here are some key points about it: Vulnerability details: Improper…
-
CVE-2025-0096 – Fix malloc buffer size (6th Feb 2025)
Original release date: February 3, 2025 Preface: The Hardware Abstraction Layer (HAL) is not outdated with Android 15. In fact, HAL continues to play a crucial role in the Android architecture. Android 15 includes improvements and updates to various HAL components, ensuring they remain relevant and effective for modern hardware and software requirements. Background: Android…
-
CVE-2025-0091: Block the content scheme intent in AccountTypePreferenceLoader (3rd Feb 2025)
Preface: As of January 2025, Android holds a global market share of 72.15%, which is a big jump from just 12% back in 2010. Background: The AccountTypePreferenceLoader is a class within the Android Settings app. It is responsible for loading and displaying account preferences, which include settings related to authenticator apps. This class plays a…
-
CVE-2025-0098 : Prevent activity token leaked to another process (3rd Feb 2025)
Preface: Android frameworks deliver an environment where you already have access to libraries, best practices, and extensive help documentation. As a matter of fact, there are well over ten android frameworks. Background: TaskFragmentOrganizerController[.]java is a part of the Android Open Source Project (AOSP). It is located in the services/core/java/com/android/server/wm directory of the Android framework. This…
-
CVE-2024-7881: To be or not to be (State Injection Into Hardware Prefetchers)?
Preface: instruction cache (I-cache) and a data cache (D-cache) This is the smallest and fastest type of cache memory. It’s embedded directly into the CPU, allowing it to operate at the same speed as the CPU. The L1 cache is typically divided into two parts: one for storing instructions (L1i) and one for storing data…
-
CVE-2024-0140 : NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue (24th Jan 2025)
Preface: RAPIDS™, part of NVIDIA CUDA-X, is an open-source suite of GPU-accelerated data science and AI libraries with APIs that match the most popular open-source data tools. It accelerates performance by orders of magnitude, at scale, across data pipelines. Background: RAPIDS is an open-source suite of software libraries and frameworks developed by NVIDIA to accelerate…