-
CVE-2024-38424 Use After Free in GPS (14-12-2024)
Preface: There are four global satellite navigation systems, currently GPS (United States), GLONASS (Russian Federation), Beidou (China) and Galileo (European Union). Background: Android Opensource is called HLOS. Qualcomm’s proprietary one is called non-HLOS. The Android on Snapdragon architecture is built to allow for common feature adoption across devices with Snapdragon. It represents the software features…
-
About AMD Ryzen™ AI Software: CVE-2024-21974, CVE-2024-21975 and CVE- 2024-21976 (13Nov 2024)
Preface: A pointer is a variable that stores the memory address of another variable. Unlike typical variables that hold data like numbers or characters, pointers hold the location of where data is stored in your computer’s memory. By knowing the address, pointers can access & manipulate the data at that memory location. Background: 1.Install NPU…
-
CVE-2023-40457: About BGP transitive bit be awakened (12Nov 2024)
Preface: The core purpose of a BGP UPDATE is to tell another router some traffic it can (or can no longer) send to it. However, simply knowing directly what can be sent to another router is not very useful without context. Therefore, a BGP packet is divided into two parts: Network Layer Reachability Information (NLRI)…
-
CVE-2024-50262: About Linux Classic Berkeley Packet Filter bpf (11th Nov 2024)
Preface: Common Use Cases for BPF -Network Monitoring: Tools like tcpdump and Wireshark use BPF to capture and analyze network traffic. -Security Applications: Intrusion detection systems can use BPF to filter and inspect network packets for malicious activity. Key Features of BPF: -Packet Filtering: BPF programs can filter network packets based on various criteria, such…
-
CVE-2024-38403 – Buffer Over-read in WLAN Firmware (8th Nov 2024)
Preface: BSS Transition Management enables an AP to request a voice client to transition to a specific AP, or suggest a set of preferred APs to a voice client, due to network load balancing or BSS termination. Background: A STA receiving a BSS Transition Management Request frame may respond with a BSS Transition Management Response…
-
CVE-2024-38408 – Cryptographic Issues in BT Controller (7 Nov 2024)
Preface: Snapdragon 8 Gen 2 SoC comes with many new features and technologies such as new tri-cluster architecture, AI improvements, ray tracing support, and more. However, one largely overlooked feature is dual Bluetooth. Now, it’s not going to revolutionize the Bluetooth experience on mobile devices, but it will actually solve some of the fundamental problems…
-
About CVE-2024-0134 – NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability (5th Nov 2024)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: The NVIDIA container stack is architected…
-
About CVE-2024-43080: So called Intent Redirection by Google (4th Nov 2024)
Preface: What is intent redirection and app security in Android? An intent redirection occurs when an attacker can partly or fully control the contents of an intent used to launch a new component in the context of a vulnerable app. Background: An Intent in the Android operating system is a software mechanism that allows users…
-
CVE-2024-7883 – CMSE secure state may leak from stack to floating-point registers (3rd Nov 2024)
Preface: The Cortex-M stands for the Microcontroller which is used in most of our daily life applications also starting from the automation to DSP applications, sensors, smart displays, IoT applications ,etc. Background: In April of 2024, Arm Limited published a Cortex-M Security Extensions (CMSE) Security Bulletin that identifies a potential software security issue in code…
-
AMD 000036938 – Potential Vulnerabilities When Deviating from ARM AXI Standard Protocol (1st Nov 2024)
Preface: Sandia’s Astra is the world’s fastest Arm-based supercomputer according to the technical article, the supercomputer industry’s standard. With a speed of 1.529 petaflops, Astra placed 203rd on a ranking of top computers announced at SC18, the International Conference for High Performance Computing, Networking, Storage, and Analysis, in Dallas. Background: A crossbar network is a…