-
CVE-2025-0050: Arm Mali GPU Userspace Driver could allow an Out-of-Bounds access (8th April 2025)
Preface: A Use-After-Free (UAF) vulnerability occurs when a program continues to access memory after it has been freed. This can lead to unpredictable behavior, crashes, or even allow an attacker to execute arbitrary code. For example, if a program frees a block of memory but later tries to read or write to that memory, it…
-
System Management Mode (SMM) does not follow best practices. The impact extends beyond the desktop to HPC as well! (7th Apr 2025)
Preface: In the realm of High Performance Computing (HPC), processors that use the x86 architecture typically support System Management Mode (SMM). This includes: -Intel Xeon Processors: Widely used in HPC systems, Intel Xeon processors support SMM for managing system-wide tasks such as power management and hardware control. -AMD EPYC Processors: AMD EPYC processors, including the…
-
CVE-2025-3305: code projects IKUN_Library – Improper access control and incorrect privilege assignment (6th Apr 2025)
Preface: Investment bank use Spring Boot for developing microservices and REST APIs. Hospitality utilizes Spring Boot for various backend services. Automotive company Uses Spring Boot for configuration management and service discovery. Background: IKUN_Library 1.0 is a library management system developed using SpringBoot and MyBatis. It provides functionalities for managing books, readers, and borrowing records. The…
-
About AMD Ryzen™ AI Software: CVE-2025-0014, CVE-2024-36337,CVE-2024-36336 & CVE-2024-36328 (3th Apr 2025)
Preface: The Ryzen 7000 desktop and laptop chips were introduced in 2023. Alongside the main x86 CPU, Ryzen 7000 has a new type of coprocessor, a Neural Processing Unit (NPU), based on the XDNA™ AI Engine architecture. This new NPU is called Ryzen AI. Background: 1.Install NPU Drivers 2.Download the NPU driver installation package NPU…
-
CVE-2025-21983: While kvfree_rcu() itself is not fundamentally flawed, Linux now been resolved by using a more appropriate workqueue. (2nd Apr 2025)
Preface: The buddy allocator is a well-known memory management algorithm used in the Linux kernel. It is designed to efficiently allocate and deallocate memory in contiguous blocks. Background: What is RCU usage in the Linux kernel? Read-copy update (RCU) is a scalable high-performance synchronization mechanism implemented in the Linux kernel. RCU’s novel properties include support…
-
CVE-2025-2953: Floating point exception in torch[.]mkldnn_max_pool2d (31st Mar 2025)
Preface: The torch[.]nn[.]MaxPool2d function in PyTorch is used to apply a 2D max pooling operation over an input signal, which is typically an image or a batch of images. Background: A floating point exception crash when using torch[.]mkldnn_max_pool2d can occur due to several reasons, often related to invalid or extreme values for parameters like kernel…
-
Similar to previously disclosed side-channel attacks. Manufacturer (AMD) response to researcher (30-03-2025)
Preface: On 24th Oct, 2024, Researchers from Azure® Research, Microsoft® have provided to AMD a paper titled “Principled Microarchitectural Isolation on Cloud CPUs.” In their paper, the researchers describe a potential side-channel vulnerability on AMD CPUs. AMD believes that existing mitigation recommendations for prime and probe side-channel attacks remain applicable to the presented vulnerability. Background:…
-
CVE-2025-30217: SQL injection on Frappe web application framework (27th Mar 2025)
Preface: The Frappe Framework comes equipped with a wide range of built-in tools and features that accelerate the development process. Developers can leverage ready-to-use modules, templates, and components to create applications quickly. Background: Frappe Framework – A full-stack web application framework written in Python and Javascript. The framework provides a robust foundation for building web…
-
CVE-2025-30219: About RabbitMQ (26th Mar 2025)
Preface: Message queues are quite important in machine learning for several reasons: Background: RabbitMQ can be quite helpful in AI applications! RabbitMQ is an open-source message broker that facilitates communication between different parts of a system asynchronously. Here are some ways it can assist AI: If you enable the management Plugin, you will be able…
-
CVE-2025-24514: Security Focus of K8s (Kubernetes) 24th Mar 2025
Preface: A Kubernetes (K8s) sidecar controller is a custom controller designed to manage sidecar containers within a Kubernetes Pod. Sidecar containers are secondary containers that run alongside the main application container in the same Pod. They provide additional functionalities such as logging, monitoring, security, or data synchronization without altering the primary application code. Background: Ingress…