-
CVE-2024-21944: Undermining Integrity Features of SEV-SNP with Memory Aliasing
Preface: The Serial Presence Detect function is implemented using a 2048 bit EEPROM component. This nonvolatile storage device contains data programmed by the DIMM manufacturer that identifies the module type and various SDRAM organization and timing parameters. EEPROM stands for Electrically Erasable Programmable Read-Only Memory. It’s a type of non-volatile memory used in computers and…
-
CVE-2024-49194: Databricks JDBC Driver Vulnerability Advisory (19th Dec 2024)
Preface: The Databricks Platform is the world’s first data intelligence platform powered by generative AI. Infuse AI into every facet of your business. Generative artificial intelligence, also known as generative AI or gen AI for short, is a type of AI that can create new content and ideas, including conversations, stories, images, videos, and music.…
-
CVE-2024-10205: Authentication bypass vulnerability exists in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer (18-12-2024)
Preface: Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). Background: Hitachi…
-
About Siemens: CVE-2024-49775 – Heap-based Buffer Overflow Vulnerability in User Management Component (UMC)
Preface: SIMATIC WinCC is a supervisory control and data acquisition (SCADA) and human-machine interface (HMI) system from Siemens. SCADA systems are used to monitor and control physical processes involved in industry and infrastructure on a large scale and over long distances. SIMATIC WinCC can be used in combination with Siemens controllers. WinCC is written for…
-
CVE-2024-33063 – OOB : read/writes in ML probe generation (15-Dec 2024)
Preface: A patch published June 2023, adds parsing of the data and adding/updating the BSS using the received elements. Doing this means that userspace can discover the BSSes using an ML probe request and request association on these links. Background: IE provides information on channel usage by AP, so that smart wireless stations can decide…
-
CVE-2024-5660: This issue could allow a modified, untrusted guest operating system to compromise the host in certain hypervisor environments. (11 Dec 2024)
Preface: NVIDIA Jetson™ is the world’s leading embedded AI computing platform with an integrated Arm CPU. Background: The owning translation regime uses its address translation table data to determine the properties of the trace data transactions written to system memory. CPUECTLR_EL1 is a 64-bit register, and is part of the 64-bit registers functional group. This…
-
[CVE-2024-47586] SAP NetWeaver AS ABAP NULL Pointer Dereference (3504390) – 11 Dec 2024
Preface: In computing, an oops is a serious but non-fatal error in the Linux kernel. An oops may precede a kernel panic, but it may also allow continued operation with compromised reliability. Background: The Internet Communication Manager ensures that communication between the SAP System (SAP NetWeaver Application Server) and the outside world via HTTP, HTTPS…
-
CVE-2024-53143 – fsnotify: Fix ordering of iput() and watched_objects decrement (10 Dec 2024)
Preface: The Go language is also developed on fsnotify, but the file extension is fsnotify[.]go. fsnotify is a Go library to provide cross-platform filesystem notifications on Windows, Linux, macOS, BSD, and illumos. Go 1.17 or newer is . Background: In Linux, fsnotify is actually implemented based on the inotify system call. inotify is a subsystem of…
-
CVE-2024-43767: Size overflow when allocating SkMask data (8th Dec 2024)
Preface: Yes, it is possible to develop an Android app using C++. While Java and Kotlin are the recommended languages for Android development. Many memory manipulation functions in C and C++ do not perform bounds checking and can easily overwrite the allocated bounds of the buffers they operate upon. Background: Skia Graphics Library (SGL) is…
-
CVE-2024-38920: Use-after-free issue related to the humble version of Open Robotics Robot Operating System 2 (ROS2) and Nav2 (6 Dec 2024)
Preface: Use-after-free (UAF) vulnerabilities are a class of software flaws that involve using a memory resident object after it has been freed. UAF vulnerabilities most commonly occur when a C++ object that was allocated on the heap is accessed after it is deleted, but stack-allocated objects can also be used after a free. Background: The…