Ercument Buyuksumnulu’s Post

39 hardware vulnerabilities: A guide to the threats https://trib.al/Wev7pGT

"Microarchitectural attacks threaten the security of computer systems even in the absence of software vulnerabilities. While x86 and ARM CPUs have been extensively studied, the rising popularity of RISC-V CPUs demands a thorough examination of their microarchitectural attack surface. With the standardization of the RISC-V instruction set architecture and the announcement of support for the architecture by major processor vendors, RISC-V CPUs are on the verge of becoming ubiquitous. In this talk, we will show a systematic investigation of the microarchitectural attack surface on the first commercially-available 64-bit hardware RISC-V CPUs..." https://lnkd.in/escXsGKE

Arm Warns of Actively Exploited Zero-Day Vulnerability in Mali GPU Drivers Arm has issued a warning about a security vulnerability, tracked as CVE-2024-4610, affecting its Mali GPU Kernel Driver. The company reported that this use-after-free issue has been actively exploited. Impacted products include all versions of the Bifrost and Valhall GPU Kernel Driver from r34p0 to r40p0. The vulnerability highlights potential risks for local non-privileged users manipulating GPU memory.

Arm is warning of a security vulnerability impacting Mali GPU Kernel Driver that it said has been actively exploited in the wild. Tracked as CVE-2024-4610, the use-after-free issue impacts the following products - Bifrost GPU Kernel Driver (all versions from r34p0 to r40p0) Valhall GPU Kernel Driver (all versions from r34p0 to r40p0) "A local non-privileged user can make improper GPU memory

❓ Are Your Devices Safe from the Latest Arm CPU Vulnerability? ❓ Researchers have uncovered a new TikTag attack targeting the MTE security feature in Arm CPUs, demonstrating how attackers could bypass protections in devices we rely on daily. A team from Seoul National University, Samsung Research, and Georgia Institute of Technology revealed that this attack leverages speculative execution to leak MTE tags, enabling exploitation of memory corruption vulnerabilities. Their findings, open-sourced for the cybersecurity community, highlight significant risks for the Chrome browser and Linux kernel, achieving a success rate of over 95% in just seconds. Arm's response emphasizes that while MTE provides essential defenses, it's not foolproof against advanced adversaries. This underscores the importance of continuous vigilance and innovation in endpoint security. At Sentinel360, we stay ahead of such threats to protect your data. Stay informed, stay secure. Follow us for more critical updates! Read in full 👉 https://lnkd.in/eMPGTQ-Z #Cybersecurity #EndpointSecurity #SpeculativeExecution #ArmCPU #TikTag #Sentinel360 #FollowForMore

We found a bunch of platform vulnerabilities recently that the vendors have been slow to address. So much so that we developed our own tool to help you see if you are vulnerable, called Platbox. To determine whether you are vulnerable, we recommend running Platbox (https://lnkd.in/ez5__vGr) and, if that is the case, reaching out to the vendor in the hope that they will address these issues. Read the full run down of the research here. https://lnkd.in/ehHTRpSs

Once again #firmware #security flaws being discussed, we are seriously checking the end-of-life , end-of-services for the IT infrastructure, however, such root level flaws may go uncovered, thoughts? #threatdetection #cybersecurity #firmwareprotection #trustedadvisors #informationprotection #cisoadvisor #hardware #attacksurface

Patch your systems ASAP! A recently discovered vulnerability, dubbed "UEFIcanhazbufferoverflow" (CVE-2024-0762), poses a serious threat to devices with Phoenix SecureCore™ UEFI firmware. This vulnerability scores a concerning 7.5 on the CVSS scale, indicating a high potential for exploitation. Remember, security is a shared responsibility. By staying informed and taking proactive measures, we can work together to keep our devices and data safe.

Researchers Uncover UEFI Vulnerability Affecting Multiple Intel CPUs: Cybersecurity researchers have disclosed details of a now-patched security flaw in Phoenix SecureCore UEFI firmware that affects multiple families of Intel Core desktop and mobile processors. Tracked as CVE-2024-0762 (CVSS score: 7.5), the "UEFIcanhazbufferoverflow" vulnerability has been described as a case of a buffer overflow stemming from the use of an unsafe variable in the Trusted Platform https://lnkd.in/gasgqRh3