-
Similar to previously disclosed side-channel attacks. Manufacturer (AMD) response to researcher (30-03-2025)
Preface: On 24th Oct, 2024, Researchers from Azure® Research, Microsoft® have provided to AMD a paper titled “Principled Microarchitectural Isolation on Cloud CPUs.” In their paper, the researchers describe a potential side-channel vulnerability on AMD CPUs. AMD believes that existing mitigation recommendations for prime and probe side-channel attacks remain applicable to the presented vulnerability. Background:…
-
A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 (18-03-2025)
Preface: Stateless applications perform tasks based on the input provided in the current transaction. These applications make use of Content Delivery Network (CDN) and web to process short term requests. Unlike stateful applications, stateless applications do not save users data. There is no stored knowledge or information for reference to past records. Containers are widely…
-
CVE-2024-0114: NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller HMC (7 th March 2025)
Preface: NVIDIA collaborates with Supermicro for their server solutions, including the use of Supermicro’s BMC (Baseboard Management Controller) in certain systems. Supermicro provides a range of server solutions optimized for NVIDIA’s platforms. Background: The NVIDIA Hopper HGX for 8 GPUs has several standout features: High Performance: It hosts eight H100 Tensor Core GPUs, which are…
-
PAGE PREFETCHER ATTACK – AMD ID: AMD-SB-7040 (28-2-2025)
Preface: Page prefetching is a technique used to improve performance by preloading data into the cache before it’s actually needed. However, the implementation and presence of a page prefetcher can vary depending on the CPU architecture and design. Background: A page prefetcher attack is a type of side-channel attack that exploits the page prefetching mechanism…
-
Python , have ever you though? (25-02-2025)
Preface: Maintaining a satellite’s orbit involves a combination of precise calculations and regular adjustments. Here are the key factors: Background: The PyEphem module provides highly precise data on the planets and our solar system. This module leverages an extremely robust C library that allows you to pinpoint planets, perform interplanetary calculations and discover more data…
-
CVE-2023-31315: AMD SMM Lock Bypass (21-Aug-2024)
Preface: AMD EPYC™ Processors power the highest-performing x86 servers for the modern data center, on prem and in cloud environments, across industries. Background: Model-specific registers (MSR) are control registers provided by the processor implementation so that system software can interact with a variety of features, including performance monitoring, checking processor status, debugging, program tracing or…
-
CVE-2023-52910 – iommu/iova: Fix alloc iova overflows issue (21-08-2024)
Preface: Modern hardware provides an I/O memory management unit (IOMMU) that mediates direct memory accesses (DMAs) by I/O devices in the same way that a processor’s MMU mediates memory accesses by instructions. Background: With IOMMU, when the device performs DMA access to memory, the system returns to the device driver no longer a physical address,…
-
CVE-2024-44070: FRRouting (FRR) – bgpd – ensure the hash works (18th Aug 2024)
Preface: As Time Goes By , OSS (Open Source Software) for use by cost-conscious commercial companies. It is quite popular in cloud. Background: FRRouting (FRR) is a free and open source Internet routing protocol suite for Linux and Unix platforms. It implements BGP, OSPF, RIP, IS-IS, PIM, LDP, BFD, Babel, PBR, OpenFabric and VRRP, with…
-
CVE-2024-43855: md/raid5 – recheck if reshape has finished with device_lock held. From technical point of view, it also impact RedHat cluster. (18 Aug 2024)
Preface: LVM version 2, or LVM2, is the default for Red Hat Enterprise Linux, which uses the device mapper driver contained in the 2.6 kernel. LVM2, which is almost completely compatible with the earlier LVM1 version, can be upgraded from versions of Red Hat Enterprise Linux running the 2.4 kernel. The Clustered Logical Volume Manager…
-
CVE-2024-21969: (AMD security focus) Whispering Pixels – Exploiting Uninitialized Register Accesses in Modern GPUs (14th Aug 2024)
Preface: The new AMD Radeon Instinct MI50 hints at the capabilities of AMD’s future GPUs. A study proof MI50 is capable scientific and ML applications. Background: The proliferation of graphics processing units (GPUs) has brought unprecedented computing power. Multiple register-based vulnerabilities found across different GPU implementations. So-called whisper pixels. The vulnerability poses unique challenges to…