-
CVE-2025-21479: Incorrect Authorization in Graphics (2nd June 2025)
Preface: Snapdragon chipsets, which are a type of System-on-a-Chip (SoC), often include memory components, such as RAM (Random Access Memory) and ROM (Read-Only Memory), within the chip itself. This integrated approach allows for faster and more efficient data processing within the device. Background: In Qualcomm Snapdragon SoCs, the Adreno GPU is responsible for graphics and…
-
CVE-2025-35003: Apache NuttX RTOS Bluetooth Stack (HCI and UART components) 27-5-2025
Preface: During the Dahe period of Emperor Wenzong of the Tang Dynasty (827-835 AD), there was a scholar named Zheng Renben(鄭仁本), his cousin and his friend Wang Xiucai(王秀才) wandering in Zhongyue Songshan Mountain(中嶽嵩山) and got lost in a deep valley. It was getting dark at this time, and the two were very scared. As they…
-
CVE-2025-27558: FragAttacks against mesh networks (21-05-2025)
Preface: A Mesh Basic Service Set (MBSS) is a self-contained wireless network created by a group of interconnected mesh stations (STAs). Each mesh station can act as both an access point and a mesh node, enabling communication and data sharing within the mesh network. The MBSS uses a “mesh profile” to define the network’s characteristics,…
-
CVE-2025-21460: Improper Input Validation in Automotive Software platform based on QNX. (13th May 2025)
Preface: As of June 26, 2023, QNX software is now embedded in over 255 million vehicles worldwide, including most leading OEMs and Tier 1s, such as BMW, Bosch, Continental, Dongfeng Motor, Geely, Ford, Honda, Mercedes-Benz, Subaru, Toyota, Volkswagen, Volvo, and more. Background: In Automotive Ethernet Audio Video Bridging (eAVB), reliable communication is not limited to…
-
CVE-2024-45551: Weak Authentication in HLOS (16-04-2025)
NVD Published Date: 04/07/2025 NVD Last Modified: 04/07/2025 Preface: Released on September 3, 2024 as Android 15. Android 16, Internal codename as Baklava, released on 2nd April 2025. Background: The core of the Android OS operating system is the Android Open Source Project (AOSP), which is free open source software (FOSS) licensed primarily under the…
-
CVE-2025-21443: Memory corruption while processing message content in eAVB. (13th Apr 2025)
Preface: The Snapdragon SA8540P SoC and SA9000P AI accelerator are designed to work together seamlessly, particularly in advanced driver-assistance systems (ADAS) like GM’s Ultra Cruise. The buffer sharing design between these components is crucial for efficient data processing and low-latency performance. In automotive Ethernet Audio Video Bridging (eAVB), processors handle various types of message content…
-
2024-53022: Memory corruption may occur during communication between primary and guest VM (6th Mar 2025)
Preface: QNX hypervisors are available in two variants: QNX Hypervisor and QNX Hypervisor for Safety. The QNX Hypervisor variant (QH), which includes QNX Hypervisor 8.0, is not a safety-certified product. It must not be used in a safety-related production system. If you are building a safety-related system, you must use the QNX Hypervisor for Safety…
-
CVE-2020-24658: A year-old vulnerability is still hiding in embedded systems (3rd Mar 2025)
Preface: Many programmers continue to use Arm Compiler 5 for several reasons: Developers who have been using Arm Compiler 5 for years are familiar with its quirks and features, making it easier for them to continue using it rather than learning a new toolchain. Furthermore, Arm Compiler 5 supports older ARM architectures that may not…
-
CVE-2024-33063 – OOB : read/writes in ML probe generation (15-Dec 2024)
Preface: A patch published June 2023, adds parsing of the data and adding/updating the BSS using the received elements. Doing this means that userspace can discover the BSSes using an ML probe request and request association on these links. Background: IE provides information on channel usage by AP, so that smart wireless stations can decide…
-
CVE-2024-5660: This issue could allow a modified, untrusted guest operating system to compromise the host in certain hypervisor environments. (11 Dec 2024)
Preface: NVIDIA Jetson™ is the world’s leading embedded AI computing platform with an integrated Arm CPU. Background: The owning translation regime uses its address translation table data to determine the properties of the trace data transactions written to system memory. CPUECTLR_EL1 is a 64-bit register, and is part of the 64-bit registers functional group. This…