-
About CVE-2024-33066: Memory corruption while redirecting log file to any file location with any file name, said Qualcomm (8th Oct 2024)
Preface: To redirect the standard error output of a command to a file in the Linux shell, you can use the “2>” operator followed by the name of the file where you want to redirect the stderr. Additionally, you can combine the stderr and stdout streams using the “2>&1” operator if you want to redirect…
-
CVE-2024-38812: Is it a known design weakness in past or it is a new findings? (7th Oct 2024)
Preface: System-Dependent IDL Preprocessor Variables The following system-dependent preprocessor variables are used in building the IDL compiler. They are all defined in: dce-root-dir/dce/src/rpc/idl/idl_compiler/sysdep[.]h AUTO_HEAP_STACK_THRESHOLD defines an estimate for the maximum size of a stack in a server stub. If the IDL compiler estimates that this amount will be exceeded, objects will be allocated via malloc…
-
CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)
Preface: Kafka understands only byte arrays. Kafka acts as a Broker to convert and transmit data over the network between producers and consumers. But it need a mechanism to convert data into a format that Kafka, producers and consumers can understand. Background: Apache Avro is a powerful data serialization framework that provides many useful features.…
-
CVE‑2024-0103, CVE-2024-0104 & CVE-2024-0105 Interference from the development of supercomputers and artificial intelligence (3rd Oct 2024)
Preface: OpenAI revealed that the project cost $100 million, took 100 days, and used 25,000 NVIDIA A100 GPUs. Each server equipped with these GPUs uses approximately 6.5 kW, so an estimated 50 GWh of energy is consumed during training. Background: Parallel processing is a method in computing of running two or more processors (CPUs) to…
-
CVE-2024-0116: NVIDIA Triton Inference Server contains a vulnerability where a user may cause an out-of-bounds.(2nd Oct 2024)
Preface: Some systems which implement malloc() may not release memory back to the operating system right away causing a false memory leak. Background: Triton Inference Server provides a cloud and edge inferencing solution optimized for both CPUs and GPUs. Triton supports an HTTP/REST and GRPC protocol that allows remote clients to request inferencing for any…
-
CVE-2024-23935: Car owners should be vigilant! (30th Sep 2024)
Preface: ISO/SAE 21434 describes Threat Analysis and Risk Assessment (TARA) to assess the cybersecurity risks in the product. ISO/SAE 21434 stresses the importance of executive management’s commitment to cybersecurity by providing specific guidelines for those responsibilities. Background: The iLX-F905D Alpine Halo9 is the second generation of the Halo product line, featuring a 9-inch high-resolution WXGA…
-
CVE-2024-0132: About NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability (25th Sep 2024)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: The NVIDIA container stack is architected…
-
CVE-2024-41445: Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread (25-09-2024)
Preface: What is an MF4/MDF4 file? Measurement Data Format version 4 (MDF 4) is a standard file format by ASAM used by the automotive industry for storing measurement data in binary file format. It records CAN, CAN FD, LIN bus data, sensor data from an engine control unit (ECU), offering interoperability across many CAN tools. Background:…
-
CVE-2024-39928: Vulnerability in Apache Linkis – Spark EngineConn (25-09-2024)
Preface: Apache Linkis is a computation middleware that acts as a layer between upper-level applications and underlying engines, such as Apache Spark, Apache Hive and Apache Flink. It started as an Apache Incubator project in 2021 and graduated to a Top Level Project in January 2023. Background: Linkis provides standardized interfaces (REST, JDBC, WebSocket etc.)…
-
CVE-2024-41721 – Critical vulnerability affecting FreeBSD’s bhyve hypervisor (24-09-2024)
Preface: Today, FreeBSD is used by many IT companies such as IBM, Nokia, Juniper Networks, and NetApp to build their products. Background: bhyve, pronounced “beehive” is a hypervisor/virtual machine manager for FreeBSD that supports a wide range of guest operating systems on Intel and AMD processors that support the “POPCNT” (POPulation Count) feature, and experimentally…