-
CVE-2024-36138: Bypass incomplete fix of CVE-2024-27980 (10 Jul 2024)
Preface: Node. js has two types of threads: one Event Loop and k Workers. The Event Loop is responsible for JavaScript callbacks and non-blocking I/O, and a Worker executes tasks corresponding to C++ code that completes an asynchronous request, including blocking I/O and CPU-intensive work. Background: Why do we use child process in Node.js? Node…
-
CVE-2024-6563: About Renesas arm-trusted-firmware (9 Jul 2024)
Preface: Trusted Firmware-M (TF-M) defines several common profiles, such as Profile Small, Profile Medium, Profile Medium ARoT-less and Profile Large, to provide different levels of security to adapt to different device functions and applications. Use cases on top of firmware. Background: The capabilities and resources of different IoT devices can vary significantly. Some IoT devices…
-
CVE-2024-20081: Out-of-bounds write in gnss, response by Mediatek security advisory. (2nd July 2024)
Preface: GPS traditionally refers to the North American Global Positioning System, or satellite positioning system. GNSS is the term for the international multi-constellation satellite system. Therefore, GNSS typically includes GPS, GLONASS, Baidu, Galileo, and any other constellation system. Background: GNSS positioning modules or chips, as the core component of In-vehicle Infotainment systems, provide position, speed,…
-
About CVE-2024-38952 on PX4-Autopilot v1.14.3 (27 June 2024)
Preface: The PX4 is a professional autopilot. Developed by world-class developers from industry and academia and supported by an active worldwide community, it powers a variety of vehicles from racing and cargo drones to ground vehicles and submersibles. Background: What is needed to control a drone using PX4 flight controller? -A computer with Internet Access.…
-
CVE-2024-38663: blk-cgroup – fix list corruption from resetting io stat (25-June-2024)
Preface: Android uses cgroups to control and account for system resources such as CPU and memory usage and allocation, with support for Linux kernel cgroups v1 and cgroups v2. Background: New IO stats are stored in the percpu iostat_cpu within blkcg_gq (blkg). There are multiple blkg’s (one for each block device) attached to each blkcg.…
-
CVE-2024-21478 – Automotive manufacturer staying alert! (18 June 2024)
Preface: For example, if your app defines a fence for headphones, it gets callbacks when the headphones are plugged in and when they’re unplugged. Background: Automotive infotainment is an in-car system that combines entertainment such as radio and music playing with driving information, including navigation, ADAS, and vehicle settings. The SA8255P delivers next-generation Qualcomm Snapdragon…
-
CVE-2024-4610: Arm was recently aware of this vulnerability being exploited in the wild (17 June 2024)
Arm has released limited details about the vulnerability. Do you think the following is similar to CVE-2024-4610? Preface: Arm was recently aware of reports of this vulnerability being exploited in the wild, but this exploit was a local attack. Perhaps, cybercriminals should help via email phishing or SMS functionality. Therefore, it attracted the attention of…
-
CVE-2023-20597: AGESA™ firmware versions previously provided did not sufficiently mitigate CVE-2023-20594. Release 2nd round of remedy.(13-June-2024)
Preface: June 2024 Update – After additional analysis, AMD believes that the Client AGESA™ firmware versions previously provided did not sufficiently mitigate CVE-2023-20594. This security bulletin has been updated with new Client AGESA™ firmware versions that contain updated mitigations. Background: The DXE drivers are responsible for initializing the processor, chipset, and platform components as well…
-
CVE-2024-31335 GPU – PowerVR: Wrong order of operations in DevmemIntUnmapPMR2 may lead to temporarily dangling PTEs.AI accelerators called Neural Network Accelerator (NNA) staying alert! (7 June 2024)
Official Posted: 31st May 2024 Preface: PowerVR not limited 2D and 3D rendering, and for video encoding, decoding, associated image processing. It also develops AI accelerators called Neural Network Accelerator (NNA). The IMG Series4 is a revolutionary neural network accelerator (NNA) for the automotive industry that enables ADAS and autonomous driving. PowerVR accelerators are not…
-
CVE-2024-1086 : A use-after-free vulnerability in the Linux kernel’s netfilter. The IoT world remins vigilant. 4 June 2024
Preface: By default, OpenWrt builds the kernel with a useful set of netfilter capabilities for a robust router. NAT. REJECT. REDIRECT. CONNTRACK. LOG. OpenWrt is a Linux distribution suitable for embedded devices. Currently, many embedded hardware platforms on the market use OpenWrt as their basis, such as routers, network gateways or industrial use computer Background:…