-
CVE-2024-6563: About Renesas arm-trusted-firmware (9 Jul 2024)
Preface: Trusted Firmware-M (TF-M) defines several common profiles, such as Profile Small, Profile Medium, Profile Medium ARoT-less and Profile Large, to provide different levels of security to adapt to different device functions and applications. Use cases on top of firmware. Background: The capabilities and resources of different IoT devices can vary significantly. Some IoT devices…
-
CVE-2024-39486: Direct Rendering Manager (DRM) of video card. A race leads to use-after-free of a “struct pid” (8 Jul 2024)
Preface: The display pipeline driver responsible for interfacing with the display uses the kernel mode setting (KMS) API and the GPU responsible for drawing objects into memory uses the direct rendering manager (DRM) API. Background: The Direct Rendering Manager (DRM) is a subsystem of the Linux kernel responsible for interfacing with GPUs of modern video…
-
Get closer look CVE-2024-39920: About “SnailLoad” issue (5-Jul-2024)
NVD Published Date: 07/03/2024 Preface: How is RTT measured in TCP? Measures the time from sending a packet to getting an acknowledgment packet from the target host. Background: A new technology standard called “RFC 9293” was released on August 18, 2022. Highlight: -Acknowledgment Number: 32 bits – If the ACK control bit is set, this…
-
CVE-2024-39309: prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. (3-Jul-2024)
Preface: Parse was founded in 2011 by Tikhon Bernstam, Ilya Sukhar, James Yu, and Kevin Lacker, previously at Google and Y Combinator. An open source backend-as-a-service (BaaS) framework originally developed by Facebook. On January 28, 2016, Facebook open sourced the Parse Platform and announced that it would shut down the Parse hosting service. However, the…
-
CVE-2024-20081: Out-of-bounds write in gnss, response by Mediatek security advisory. (2nd July 2024)
Preface: GPS traditionally refers to the North American Global Positioning System, or satellite positioning system. GNSS is the term for the international multi-constellation satellite system. Therefore, GNSS typically includes GPS, GLONASS, Baidu, Galileo, and any other constellation system. Background: GNSS positioning modules or chips, as the core component of In-vehicle Infotainment systems, provide position, speed,…
-
CVE-2024-37371: About MIT Kerberos 5 (2nd July 2024)
Preface: Kerberos is built into all major operating systems, including those from Microsoft, Apple, Red Hat, and Sun. Kerberos is the authentication mechanism for some devices like Microsoft Active Directory and even X-Box. LDAP is primarily used for managing and accessing directories, while Kerberos is designed to provide security authentication for client/server applications. Background: MIT…
-
About CVE-2024-37571: SAS: Data and AI Solutions (SAS Broker – V9.2, build 1495) 26-June-2024
Preface: What’s required to create good machine learning systems? -Data preparation capabilities. -Algorithms – basic and advanced. -Automation and iterative processes. -Scalability. -Ensemble modeling. Did you know? -In machine learning, a target is called a label. -In statistics, a target is called a dependent variable. -A variable in statistics is called a feature in machine…
-
About CVE-2024-38952 on PX4-Autopilot v1.14.3 (27 June 2024)
Preface: The PX4 is a professional autopilot. Developed by world-class developers from industry and academia and supported by an active worldwide community, it powers a variety of vehicles from racing and cargo drones to ground vehicles and submersibles. Background: What is needed to control a drone using PX4 flight controller? -A computer with Internet Access.…
-
CVE-2024-38663: blk-cgroup – fix list corruption from resetting io stat (25-June-2024)
Preface: Android uses cgroups to control and account for system resources such as CPU and memory usage and allocation, with support for Linux kernel cgroups v1 and cgroups v2. Background: New IO stats are stored in the percpu iostat_cpu within blkcg_gq (blkg). There are multiple blkg’s (one for each block device) attached to each blkcg.…
-
About LoLLMS WebUI: CVE-2024-5443 design flaw related to CVE-2024-4320 (NVD Last Modified: 06/24/2024)
Preface: Large language models (LLM) are very large deep learning models that are pre-trained on vast amounts of data. The underlying transformer is a set of neural networks that consist of an encoder and a decoder with self-attention capabilities. The key feature of a multimodal model is its ability to integrate and interpret information from…