-
CVE-2025-21450: Improper Authentication in GPS GNSS (7th July 2025)
Preface: GNSS – This is a global term encompassing all satellite constellations that provide positioning, navigation, and timing (PNT) services. Besides GPS, other GNSS include GLONASS (Russia), Galileo (EU), and BeiDou (China). GPS – The Global Positioning System, developed by the US Department of Defense, is the most widely recognized and used GNSS. It was…
-
CVE-2025-52496: Mbed TLSan open-source C library design weakness (6th July 2025)
Preface: What is the difference between FreeRTOS and Cmsis-RTOS? Basically FreeRTOS is a RTOS, while CMSIS-RTOS is only a wrapper for any RTOS (like FreeRTOS, CMSIS-RTOS RTX or anything you want). CMSIS-RTOS is an API that enables consistent software layers with middleware and library components. Mbed TLS aims to provide a set of powerful and…
-
CVE-2025-6073 – Industrial Controls Be Aware! (4th July 2025)
Preface: The default configuration of the ABB RMC-100’s REST interface is disabled. ABB recommends leaving the REST interface disabled when not in use, particularly when configuring MQTT functionality. The RMC-100 is not intended for access over public networks. Background: The ABB RMC-100 is a popular and widely used remote modular controller, particularly within the oil…
-
CVE-2025-0038 exposes a runtime vulnerability due to missing checks in PMU firmware. (2nd July 2025)
Preface: Users typically build custom PMU firmware tailored to their specific hardware platform and application requirements. PMU firmware can be loaded by either FSBL or CSU BootROM (CBR). Both these flows are supported by AMD. Loading PMU firmware using FSBL has the following benefits: – Possible quick boot time, when PMU firmware is loaded after…
-
CVE-2025-36852: “first-to-cache wins” jeopardizes Bucket-based object storage! (12th June 2025)
Preface: Cloud service providers use “first-to-cache wins” (also known as “cache hit”) for improved performance and efficiency. By caching frequently accessed data, they can quickly retrieve it without needing to access the slower underlying storage layer. This reduces latency, enhances user experience, and can also lower costs associated with accessing and processing data. Background: In…
-
CVE-2025-2884 – Design weakness in the Trusted Platform Module (TPM) 2.0 reference implementation code. (11th June 2025)
Preface: The main difference between AMD’s Trusted Platform Module (TPM) and those from other manufacturers , how it’s implemented: AMD offers a firmware TPM (fTPM), while many other manufacturers, including Intel, also offer a dedicated hardware TPM (dTPM). Background: TPM refers to a Trusted Platform Module, which is a specialized chip that securely stores cryptographic…
-
CVE-2025-38004: An issue related to the automotive industry and Linux was discovered. (10th Jun 2025)
Preface: In the automotive industry, SocketCAN is an open-source implementation of the Controller Area Network (CAN) protocol for Linux. It provides a way for different electronic control units (ECUs) in a vehicle to communicate with each other over the CAN bus. SocketCAN uses the Linux network stack and Berkeley socket API to implement CAN device…
-
CVE-2025-0037: About AMD Versal™ Adaptive SoC – Initial publication 2025-06-03
(9th June 2025) Preface: AMD’s Versal™ Adaptive SoCs are used in a wide range of industries, particularly those requiring high-performance, low-latency processing and flexibility, such as data centers, wireless networking, automotive, aerospace, and defense. Versal chips are also utilized in areas like 5G wireless, advanced driver assist, and even 3D printing. AMD’s Versal™ Adaptive SoC…
-
CVE-2025-1246: A non-privileged user process can perform valid GPU processing operations (8th June 2025)
Preface: The Valhall family of Mali GPUs uses the same top-level architecture as the previous generation Bifrost GPUs. The Valhall family uses a unified shader core architecture. Arm’s 5th generation GPU architecture, on the other hand, is a type of GPU architecture that is designed for visual computing, especially on mobile devices, and includes features…
-
CVE-2024-53010 – Improper Access Control in Core (5th Jun 2025)
Preface: Android HLOS – -Runs on the Application Processor (main CPU) -Main Android OS (Linux kernel, system services, apps) Background: The Snapdragon 8 application processor (including variants like Snapdragon 8 Gen 3 and Snapdragon 8 Elite) uses the Adreno GPU. The Adreno GPU is a core component of Qualcomm’s Snapdragon mobile platforms and is responsible…