Public Security Advisories
Coordinated vulnerability disclosures from Argus. Findings, impact, and remediation, published in good faith.
Unchecked src_len in the RSA NOPAD paths underflows the copy destination, writing attacker-controlled bytes below the core heap buffer.
TA_FLAG_CONCURRENT is accepted from user TA headers, letting two sessions race on one shared context and free vm_region nodes that are still in use.
Unchecked src_len in the SE050 driver's RSA NOPAD paths underflows the copy destination, writing attacker-controlled bytes below the core heap buffer.
The Widevine PTA's open_session dereferences ts_get_calling_session() without a NULL check, so a direct Normal World session panics the Secure World.
// No embargoed advisories.