A Zigbee Radio Co-Processor (RCP), which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host system (CPCd) due to heavy Zigbee traffic, resulting in a Denial of Service (DoS) attack, Only hard reset will bring the device to normal operation
CVE-2024-54683 is a medium severity vulnerability in the Linux kernel's netfilter IDLETIMER component. It involves a possible ABBA deadlock caused by concurrent deletion of the last rule referencing an idletimer and reading its sysfs file. This deadlock arises from circular locking dependencies between list_mutex and another lock during teardown. The issue can cause kernel hangs or denial of service due to deadlock.
CVE-2024-47141 is a medium-severity vulnerability in the Linux kernel's pinmux subsystem. It involves a race condition when two clients simultaneously call pinctrl_select_state() for the same GPIO functionality, leading to a NULL pointer dereference. This occurs because one process updates the mux_usecount but not yet mux_owner, while another process reads the updated mux_usecount and accesses mux_owner, which may still be NULL, causing a crash. The issue is addressed by serializing access to mux-related settings using a mutex lock.
CVE-2023-3889 is a high-severity vulnerability in the Arm Ltd Valhall GPU Kernel Driver (version r38p0) that allows a local non-privileged user to perform improper GPU memory operations. This flaw involves improper restriction of operations within memory buffer bounds, potentially enabling access to freed memory areas. Exploitation could lead to full compromise of confidentiality, integrity, and availability of the affected system without requiring user interaction. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk due to its high CVSS score of 7.8. European organizations using devices with Arm Valhall GPUs, especially in embedded or mobile environments, should prioritize patching and monitoring. Mitigation includes applying vendor patches once available, restricting local user access, and employing memory protection mechanisms. Countries with strong mobile and embedded device markets, such as Germany, France, and the UK, are more likely to be impacted. The vulnerability’s ease of exploitation by local users and its broad impact on system security classify it as a high-severity threat.
