-
Mali GPU Driver Security Bulletin: CVE-2025-0427
(7th May 2025) Last updated: 2 May 2025 (official) Preface: An ioctl interface is a single system call by which userspace may communicate with device drivers. Requests on a device driver are vectored with respect to this ioctl system call, typically by a handle to the device and a request number. Background: The Arm Mali…
-
CVE-2024-49739 – GPU DDK misuse ptrace system call (6th May 2025)
Official release posted: 2nd May 2025 Since the manufacturer did not provide a detailed description, is the situation discovered by the manufacturer similar to this article details? Preface: Nvidia is a major player in the GPU market, known for its high-performance graphics cards used in gaming, professional visualization, data centers, and AI applications. Imagination Technologies…
-
CVE-2024-45552 – Buffer Over-read in Data Network Stack & Connectivity (30-04-2025)
NVD Published Date: 04/07/2025 NVD Last Modified: 04/07/2025 Preface: Real-time Transport Protocol (RTP) is a network protocol used for delivering audio and video data over the internet in real time. It is designed to provide reliable and efficient transmission of multimedia content, even in the presence of network congestion or packet loss. Background: The Snapdragon…
-
CVE-2025-31201: about RPAC – Reconfigurable Processing Architecture Core – iPhone XS and later (28-4-2025)
Official Released April 16, 2025 Preface: The Reconfigurable Processing Architecture Core (RPAC) in Apple iOS is a component found in newer Apple Silicon chips. Its major function is to enhance the security and performance of the system by providing a flexible and efficient processing architecture. RPAC is designed to support various computational tasks and can…
-
CVE-2024-53025: Transient DOS can occur while processing UCI command (24-03-2025)
NVD Published Date: 03/03/2025NVD Last Modified: 03/06/2025 Preface: The OpenWrt Project is a Linux operating system targeting embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows you to customize…
-
CVE-2025-24201: iOS, iPadOS, and macOS – WebKit Out-of-Bounds Write Vulnerability Security updates (20-03-2025)
NVD Published Date: 03/11/2025NVD Last Modified: 03/14/2025 Preface: WebKit is a web browser engine used by Safari and other applications across various platforms like macOS, iOS, Linux, and Windows. It processes web content, including JavaScript, HTML, and CSS. Background: The Web Content sandbox is a security feature within WebKit that isolates web content from the…
-
Arm CPU Security Update: Training in Transient Execution Attacks (17th Mar 2025)
Initial release: August 8, 2023 Last updated: 14 Mar 2025 Preface: AMD’s Zen3 and Zen4 architectures are not directly related to ARM design, as they are based on AMD’s own x86-64 architecture. ARM is concerned about Training in Transient Execution (TTE) attacks because these attacks exploit vulnerabilities in speculative execution, which can affect ARM processors…
-
CVE-2025-22412: Fix more memory-unsafe logging (10th Mar 2025)
Preface: In smartphones, the System on Chip (SoC), such as those made by Qualcomm, integrates various components including the CPU, GPU, and memory. The embedded OS and applications run on this SoC, utilizing its built-in memory (RAM) for processing tasks.The flash storage (often referred to as flashdisk) in smartphones is primarily used for storing persistent…
-
CVE-2025-22413: (ANDROID (KVM (arm64)) Don’t run a protected VCPU if it isn’t runnable! (5 March 2025)
Preface: The protected Kernel-based Virtual Machine (pKVM) is an advanced virtualization technology built on top of the Linux Kernel-based Virtual Machine (KVM). It is designed to enhance security and isolation for virtual machines (VMs) running on Android devices. Key points about pKVM: Enhanced Security: pKVM restricts access to the payloads running in guest VMs marked…
-
CVE-2025-0078: Ensuring that the identity of the requesting service is included and verified during inter-process communication (4th Mar 2025)
Preface: The Gospel of Matthew 24:37 As it was in the days of Noah, so it will be at the coming of the Son of Man. For in the days before the flood, people were eating and drinking,..etc Background: In Android, the ServiceManager is a key component in the Binder IPC (Inter-Process Communication) mechanism. It…