-
CVE-2024-0140 : NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue (24th Jan 2025)
Preface: RAPIDS™, part of NVIDIA CUDA-X, is an open-source suite of GPU-accelerated data science and AI libraries with APIs that match the most popular open-source data tools. It accelerates performance by orders of magnitude, at scale, across data pipelines. Background: RAPIDS is an open-source suite of software libraries and frameworks developed by NVIDIA to accelerate…
-
It is speculated that CVE-2025-0612 and CVE-2025-0611 are related to the rendering engine! (23-01-2025)
Preface: Humans have integrated smartphones (IoT) into their daily lives due to habit formation. Suddenly one day, the browsers of more than 20% of the people on the planet stopped working for half a day. Maybe you’ll see long queues outside the hospital! It similar as an intangible control to you. Go to AI age/century,…
-
Node[.]js for WebSockets: It is useful and powerful, but a cost you should pay. The design weakness of Fortinet awaken his competitors (22-01-2025)
Preface: Mars is very cold, with an average temperature of -62 degrees Celsius. Therefore, human living environments need to be designed to withstand extreme cold. Fortunately, however, these temperatures are not beyond our control. In fact, there are cities on Earth where temperatures have reached such low levels. Maybe, this is what Elon Musk meant…
-
CVE-2025-21655: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period (21-01-2025)
Preface: Is io_uring secure? io_uring has produced many security problems. Google has found it necessary to either completely forego io_uring or severely limit its use to trusted code. Background: io_uring is an asynchronous I/O interface for the Linux kernel. An io_uring is a pair of ring buffers in shared memory that are used as queues…
-
CVE‑2024‑0146: A design weakness in the Virtual GPU Manager, where a malicious guest could cause memory corruption. (20-1-2025)
CVE‑2024‑0146: A design weakness in the Virtual GPU Manager, where a malicious guest could cause memory corruption. (20-1-2025) Preface: In Kernel mode, the executing code has complete and unrestricted access to the underlying hardware. It can execute any CPU instruction and reference any memory address. Kernel mode is generally reserved for the lowest-level, most trusted…
-
CVE-2024-53869: NVIDIA Unified Memory driver for Linux design weakness. A successful exploit of this vulnerability might lead to information disclosure. (16th Jan 2025)
Preface: RAM and Unified Memory are essentially the same thing. Unified Memory is just RAM Built-in CPU chips. It’s unified with the CPU. So 128GB of RAM is adequate to 128GB of unified Memory. Background: Nvidia designs graphics processing units (GPUs) for the gaming and professional markets, as well as system on a chip units…
-
CVE-2024-11863, CVE-2024-11864 and CVE-2024-9413: Three different CVEs were discovered that expose the System Control Processor (SCP) to attack threats. (16th Jan 2025)
Preface: SCMI is a message driven interface between an SCMI agent (client) and an SCMI host (server) Background: SCP Firmware provides a software reference implementation for the System Control Processor (SCP) and Manageability Control Processor (MCP) components found in several Arm Compute Sub-Systems. Power Control System Architecture (PCSA) defines the concept of a System Control…
-
About CVE-2024-0135, CVE-2024-0136 & CVE-2024-0137 – NVIDIA Container Toolkit and NVIDIA GPU Operator contains an improper isolation vulnerability (13th Jan 2025)
Preface: In software development, time-of-check to time-of-use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by a race condition involving the checking of the state of a part of a system (such as a security credential) and the use of the results of that check. Background: The NVIDIA container stack is architected…
-
CVE-2024-43064: Permissions, Privileges, and Access Controls issue in Automotive OS Platform (14-01-2025)
Preface: QNX is also used in devices where failure is not an option. Fault tolerance was and is the biggest priority for the QNX operating system. A great example from the past is that the SpaceX Falcon rockets used the QNX Real-Time Operating System. Background: An SMMU performs a task like that of an MMU…
-
CVE-2024-45550 – Improper Validation of Array Index in DSP Services (13th Jan 2025)
Preface: IOCTL handlers allow users to communicate with the driver via the ioctl syscall. This is a prime attack surface because the driver is going to be handling userland-provided data within kernel space. Background: dxgkrnl is a driver for Hyper-V virtual compute devices, such as vGPU devices, which are projected to a Linux virtual machine…