-
CVE-2024-36008: The impact may be widespread but has been resolved. Linux, you did a great job. (21May 2024)
Preface: Syzbot has begun to report kernel findings to LKML in 2017. Syzbot is a continuous kernel build / fuzz / report aggregation system. Background: Linux has two mechanisms for setting routes, one is fib, and the other is routing generated by dynamic. fib uses route (man 8 route) to specify a static route table.…
-
Is AMD Instinct™ MI300X affected by CVE-2023-4969 (GPU memory leak). AMD has the answer. Official announcement on May 7, 2024.
This article was published on May 21, 2024. Preface: When I see the vulnerability it shows the date far away from now. Sometimes I lose interest. Maybe I’m missing a major technical detail. AMD officially released CVE-2023-4869 on March 7, 2024. It happened to wake me up! Although today is May 21, 2024, it seems…
-
CVE-2024-21792: Time-of-check Time-of-use race conditionin Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: Intel Neural Compressor is an open…
-
CVE-2024-22476: Improper input validation in some Intel® Neural Compressor software. Intel fixes exploited bugs. (16th May 2024)
Preface: Intel Neural Compressor performs model optimization to reduce the model size and increase the speed of deep learning inference for deployment on CPUs or GPUs. Background: Intel Neural Compressor is an open source Python* library that performs model compression techniques such as quantization, pruning, and knowledge distillation across multiple deep learning frameworks including TensorFlow*,…
-
Will such scenario be similar to the CVE-2024-0087 mentioned? (3May 2024)
Preface: NVIDIA Triton Inference Server, part of the NVIDIA AI platform and available with NVIDIA AI Enterprise, is open-source software that standardizes AI model deployment and execution across every workload. Background: The Triton Inference Server is available as a pre-built Docker container or you can build it from source.The Triton Docker container is available on…
-
CVE-2024-31621: The flowise version <= 1.6.5 is vulnerable to authentication bypass (29-04-2024)
Preface: What are LLM Apps? LLM apps, or Large Language Model applications, are applications that leverage the capabilities of Large Language Models (LLMs) to perform a variety of tasks. LLMs are a type of artificial intelligence (AI) that uses deep learning techniques and large datasets to understand, generate, and predict new content. Background: Flowise uses…
-
AMD urged software developers to implement best practices to avoid secret-dependent data accesses or control flows. (28-04-2024)
Originally published on April 26, 2024. Preface: (Level 3 cache) A memory bank built onto the motherboard or within the CPU module. The L3 cache feeds the L2 cache, and its memory is typically slower than the L2 memory, but faster than main memory. Background: The last-level cache (LLC) is the last chance for memory…
-
About CVE-2024-4173 – Storm in a teacup in big data world. Brocade did remedy, undocumented user “satnav” no longer present. (26th Apr 2024)
Preface: Apache Kafka was originally developed by Linkedin to solve data pipeline problems, and was later donated to the Apache Foundation as an open source project. Background: Avro facilitates the exchange of big data between programs written in any language. With the serialization service, programs can efficiently serialize data into files or into messages. The…
-
Regarding CVE-2024-26922: The vulnerability has been resolved. Can you provide more details? (25-04-2024)
Preface: Modern Linux systems require large amount of graphics memory to store frame buffers, textures, vertices and other graphics-related data. If a design flaw like CVE-2024-26922 cannot be fixed. It may trigger privilege escalation. Background: So far, GPU-attached bandwidth optimized (BO) memory has been allocated and managed primarily as the result of explicit, programmer-directed function…
-
CVE-2024-1065: About Arm 5th Gen GPU Architecture Kernel Driver (23-04-2024)
Original release date April 19, 2024 Preface: The Mali-G720 and Mali-G620 GPUs complete the world-class GPU portfolio for a wide range of consumer devices. After four generations of GPUs on the fourth-generation Valhall architecture, the latest Arm GPUs are built on a new fifth-generation GPU architecture (called Gen 5). Background: The New 5th Gen Arm…