-
About CVE-2024-41008: When a design weakness is discovered in a GPU, it is now not limited to affecting graphics cards! Machine learning should be on alert! (16th July 2024)
Preface: In computer science, reference counting is a programming technique of storing the number of references, pointers, or handles to a resource, such as an object, a block of memory, disk space, and others. In garbage collection algorithms, reference counts may be used to deallocate objects that are no longer needed. Background: The drm/amdgpu driver…
-
AMD released the CVE-2023-20587 security update on July 13, 2024.Don’t underestimate this related SPI flash design weakness! (15th Jul 2024)
Preface: SMM is the privileged mode of the processor. Like BIOS and UEFI, SMM code operates underneath the operating system. SMM has full access to physical memory, SMM-specific memory called SMRAM, MSR-specific scratchpad, the SPI flash region to read and write BIOS variables, and I/O operations. Additionally, SMM is designed to be invisible to lower…
-
CVE-2024-0102: About NVIDIA® CUDA® Toolkit. If you remember, a similar incident happened in April of this year. Believe this is a weakness of similar designs. (11 July 2024)
Preface: OpenAI revealed that the project cost $100 million, took 100 days, and used 25,000 NVIDIA A100 GPUs. Each server equipped with these GPUs uses approximately 6.5 kW, so an estimated 50 GWh of energy is consumed during training. Background: Parallel processing is a method in computing of running two or more processors (CPUs) to…
-
CVE-2024-39489: Linux kernel enhance memory management on IPv6 feature (11 July 2024)
Preface: The Linux kernel implements most of its IPv6 parts from USAGI. USAGI project was founded to improve and develop Linux IPv6 stack. The integrated USAGI version/release is unknown. Implemented into the kernel are the core functions of USAGI; the “standard” user-level programs provide basic IPv6 functionality. Background: IPv6 converting to using crypto_pool has the…
-
Get closer look CVE-2024-39920: About “SnailLoad” issue (5-Jul-2024)
NVD Published Date: 07/03/2024 Preface: How is RTT measured in TCP? Measures the time from sending a packet to getting an acknowledgment packet from the target host. Background: A new technology standard called “RFC 9293” was released on August 18, 2022. Highlight: -Acknowledgment Number: 32 bits – If the ACK control bit is set, this…
-
CVE-2024-20081: Out-of-bounds write in gnss, response by Mediatek security advisory. (2nd July 2024)
Preface: GPS traditionally refers to the North American Global Positioning System, or satellite positioning system. GNSS is the term for the international multi-constellation satellite system. Therefore, GNSS typically includes GPS, GLONASS, Baidu, Galileo, and any other constellation system. Background: GNSS positioning modules or chips, as the core component of In-vehicle Infotainment systems, provide position, speed,…
-
About LoLLMS WebUI: CVE-2024-5443 design flaw related to CVE-2024-4320 (NVD Last Modified: 06/24/2024)
Preface: Large language models (LLM) are very large deep learning models that are pre-trained on vast amounts of data. The underlying transformer is a set of neural networks that consist of an encoder and a decoder with self-attention capabilities. The key feature of a multimodal model is its ability to integrate and interpret information from…
-
CVE-2024-36532: Insecure permissions in kruise v1.6.2 (21 June 2024)
Preface: CNCF (Cloud Native Computing Foundation) is the open source, vendor-neutral hub of cloud native computing, hosting projects like Kubernetes and Prometheus to make cloud native universal and sustainable. Background: OpenKruise is a suite of extension components for Kubernetes that focuses on automated management of large-scale applications, such as deployment, upgrades, maintenance, and availability protection.…
-
CVE-2024-4610: Arm was recently aware of this vulnerability being exploited in the wild (17 June 2024)
Arm has released limited details about the vulnerability. Do you think the following is similar to CVE-2024-4610? Preface: Arm was recently aware of reports of this vulnerability being exploited in the wild, but this exploit was a local attack. Perhaps, cybercriminals should help via email phishing or SMS functionality. Therefore, it attracted the attention of…
-
CVE-2023-20597: AGESA™ firmware versions previously provided did not sufficiently mitigate CVE-2023-20594. Release 2nd round of remedy.(13-June-2024)
Preface: June 2024 Update – After additional analysis, AMD believes that the Client AGESA™ firmware versions previously provided did not sufficiently mitigate CVE-2023-20594. This security bulletin has been updated with new Client AGESA™ firmware versions that contain updated mitigations. Background: The DXE drivers are responsible for initializing the processor, chipset, and platform components as well…