-
About Qualcomm CVE-2024-4304 – Stack-based Buffer Overflow in Performance (5 Dec 2024)
Preface: Primitive types such as `int`, `double`, `char`, and `boolean` are stored directly in stack memory. Each time you declare a primitive variable, the JVM allocates a specific size of memory for it. Background: Returns the available average/minimum GPU headroom in percentage for last ‘duration’ seconds. The get_gpu_headroom() API is used by applications to get…
-
About Qualcomm – CVE-2024-33056 Buffer Over-read in MProc (4th Dec 2024)
Preface: What is a buffer over-read? The opposite of a buffer overflow is a buffer overread. In this case, the program requests data from outside the buffer. Because data read from outside the buffer is irrelevant to the program, it may cause the program to crash or behave unexpectedly. Background: Qualcomm SoC chips are divided…
-
About Qualcomm – CVE-2024-33044 (3 Dec 2024)
Preface: The Qualcomm Hypervisor provides a modern virtualization framework that allows multiple operating systems to run independently and concurrently, delivering high performance. The Qualcomm Type 1 Hypervisor facilitates the hosting of multiple trusted execution environments for secure use cases. Background: On some Qualcomm platforms, the hypervisor emulates more than 128 SMR (Stream Matching Register) groups.…
-
About CVE-2024-43703 from Imaginetech (2Dec 2024)
Preface: Preface: Imagination Technologies Group Limited is a British semiconductor and software design company owned by Canyon Bridge Capital Partners, a private equity fund based in Beijing that is ultimately owned by the Chinese government. With its global headquarters in Kings Langley, England, its primary business is in the design of PowerVR mobile graphics processors…
-
CVE-2023-52922 : Fix Use-After-Free in bcm_proc_show() (29 Nov 2024)
Preface: A zero-day exploit targeting a use-after-free (UAF) vulnerability in the Linux Kernel. Staying Alert! Slab–use–after–free vulnerabilities occur when memory that’s been previously freed is accessed again, often leading to unpredictable behavior or system crashes. KernelAddressSANitizer (KASAN) is a dynamic memory error detector designed to find out-of-bound and use–after–free bugs. Background: The Controller Area Network…
-
CVE-2024-0139 – NVIDIA Base Command Manager and Bright Cluster Manager for Linux contain an insecure temporary file vulnerability (28 Nov 2024)
Preface: Nvidia acquires Bright Computing, maker of Bright Cluster Manager software that controls the configuration of clustered HPC systems, including Nvidia’s own DGX servers and HGX systems manufactured by OEMs and ODMs, as well as clusters from other manufacturers. Background: NVIDIA Base Command Manager provides cluster management software for streamlining cluster provisioning, workload management, and…
-
CVE-2024-0130: About design weakness on NVIDIA UFM Enterprise, UFM Appliance, and UFM CyberAI (27 Nov 2024)
Preface: Artificial intelligence penetrates into different industries. Perhaps the expansion of some HPC supercomputers is not limited to regions. They can be run on a blockchain network to build a matrix. Background: In today’s high-performance computing (HPC) landscape, network interconnect technology is essential in linking compute nodes to ensure efficient data transfer. Among the interconnect…
-
CVE-2024-52811 : Fix heap buffer overflow writing not validated ACK to qlog (25 Nov 2024)
Preface: Most of Google’s traffic already goes through QUIC. Several other well-known companies have also begun developing their own implementations, such as Microsoft, Facebook, CloudFlare, Mozilla, Apple, Akamai,…etc Background: By combining the best of TCP and UDP, along with encryption and better handling of modern network conditions, QUIC is set to become the foundation of…
-
CVE-2024-11393 – Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (25 Nov 2024)
Preface: What is the difference between Hugging Face and transformers? Transformers is a library that contains various state-of-the-art machine learning models, as well as a Trainer API which can be used to train models. Huggingface_hub is a library to programmatically integrate with the hub. Backgound: Masks are often used in segmentation tasks, where they provide…
-
CVE-2024-10382 – a code execution vulnerability in the Car App Android Jetpack Library (22 Nov 2024)
Preface: Android Auto is a platform running on the user’s phone, projecting the Android Auto user experience to a compatible in-vehicle infotainment system over a USB connection. Android Auto supports apps designed for in-vehicle use. Background: The Android for Cars App Library lets you bring your navigation, point of interest (POI), and internet of things…