AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
Æ / PUBLIC MALWARE INTELLIGENCE

Follow the evidence.

Published file metadata, source observations, indicators, and research history in one bounded catalog.

2,400+Reachable catalog records
67 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page

Feed collection status

Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.

1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.

Review source update dates and status
  • src_350d40f2cc69277bcaCollection status unverifiedLast successful batch: Unverified

Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.

Clear filters
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE

Test Point Break: Analysis of Huawei’s OTA Fix For BootROM Vulnerabilities

Recently we have presented our research on the remote exploitation of Huawei basebands at Black Hat USA 2021. As part of our findings, we have identified several bootloader vulnerabilities in Huawei Kirin chipsets. In addition to that publication, we have also recently disclosed an additional bootrom vulnerability (CVE-2021-22429) in Huawei Kirins. As it has been publicized, many of these bootload

First reported Aug 19, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

[BugTales] Ouchscreen: Stealing Secrets With A Little Help From Machine Learning

Today we share a fun little Huawei bug that adds a twist to our previous forays into Neural Networking-based exploitation of Android devices. In previous posts, we have shown that the Neural Networking features of modern Android devices can lead to serious - if quite traditional - vulnerabilities. This time, we present a vulnerability in which Machine Learning is not the culprit - but the tool we

First reported Dec 03, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2021-22415: Huawei NPU Kernel Driver Use-After-Free

Summary In a previous advisory we disclosed multiple vulnerabilities within the NPU device’s mmap handler and discussed how it exposes sensitive kernel data. This advisory focuses on the implementation errors in the same handler. The mapping function ignores the requested size parameter and fails to back regions of the mapped virtual memory with an actual mapping. Trying to access these holes or r

First reported Aug 02, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2021-25491: Kernel NULL Pointer Dereferences due to Missing Error Checks

There are a series of memory corruption vulnerabilities in Samsung Exynos kernels, due to improper error checks, after dma_buf_vmap calls. These bugs can be abused by various privileged processes to cause NULL pointer accesses and crash the kernel. Vulnerability Details The kernel uses the dma_buf_vmap function if it needs to map a dma buffer into the kernel address space to access its content. Th

First reported Dec 13, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2021-22412: Huawei NPU Kernel Driver Shared Memory Out of Bounds Write

Summary The NPU device’s kernel driver implements a set of ioctl handlers one of which uses unsanitized user data as an offset to retrieve a kernel structure. Fields of the structure are written with user provided values. A malicious actor can use this vulnerability to overwrite kernel memory with controlled data. The mmap handler is exposed through the /dev/davinci0 character device. Due to the a

First reported Aug 02, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

SVE-2017-8975: TOCTOU Race Condition in Samsung TrustZone SCrypto Driver

Summary Due to a race condition in input validation, the SCrypto implementation of the drTima secure driver (uuid ffffffffd0000000000000000000000a) was susceptible to a buffer overflow. The drTima secure driver implements a fully featured crypto engine entirely in software, called SCrypto. The SCrypto APIs are callable by all Trustlets without restriction. SCrypto is in fact the OpenSSL’s FIPS com

First reported Mar 03, 2018 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2021-25452: Kernel Permanent Denial of Service Vulnerability in the Vision DSP Kernel Driver

There is a memory management and a path traversal vulnerability in the vision DSP kernel driver of Exynos S20 devices. These vulnerabilities can be leveraged by a malicious untrusted application to permanently disable the device until it is factory reset. Vulnerability Details The Exynos DSP driver implements an ioctl call that allows applications to upload a custom model (graph) for the dsp devic

First reported Dec 14, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2021-22434: Huawei Arbitrary Write in BootROM USB Stack

Summary During the regular boot sequence, Huawei’s BootROM initializes the UFS hardware and the crypto engine in order to load and verify the next stage bootloader image from flash. However, when run in download mode, which maybe used for factory flashing and repair purposes, a connected host can communicate with the BootROM via USB over a serial communication channel. The basis of the communicati

First reported Aug 19, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

[BugTales] A Nerve-Racking Bug Collision in Samsung's NPU Driver

Introduction Last summer I have discovered several vulnerabilities in the implementation of Samsung’s NPU device driver. While I was working on completing my proof of concept exploit, Ben Hawkes from Google’s Project Zero reported the same vulnerabilities to Samsung. Later that year Brandon Azad released an article documenting his approach of turning these bugs into an arbitrary kernel code execut

First reported Jun 08, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2021-22389: Huawei NPU Kernel Driver Exposes Kernel Structures in Shared Memory

Summary The NPU device’s kernel driver implements a custom mmap handler that exposes trusted kernel data to user space. These exposed structures contain sensitive data, including kernel pointers, which can be controlled by a user process. The content of these structures is inherently trusted by the kernel, the pointers are accessed for reading and writing at various places. This provides a very co

First reported Aug 02, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

Kernel Vmalloc Use-After-Free in the ION Allocator

Summary In this advisory we are disclosing a vmap/vmalloc use-after-free vulnerability within the Android ION allocator, that impacts most Android devices that utilize ION. The exploitability of the vulnerability depends on how the various kernel drivers use the allocated ION buffers, the version of the kernel and the vendor specific modifications to the ION subsystem. In the most serious cases th

First reported Sep 22, 2021 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2021-37107: Huawei Peripheral DMA Memory Access Permission Bypass

Summary Last year we published research at Black Hat in which we disclosed multiple vulnerabilities in Huawei Kirin SoC’s DDR Controller (DMSS) Access Permission system which allowed some SoC cores or DMA-capable peripherals to directly access secure world memory and completely compromise the entire memory of the SoC. This advisory focuses on a new access permission vulnerability in the same DMSS.

First reported May 18, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2022-22256: Huawei HWLog KASLR Leak

In this advisory we are disclosing a vulnerability in the Huawei log device that allows any unprivileged process to learn the value of randomized kernel pointers. The vulnerability can be used to defeat KASLR mitigation. Huawei kernels are shipped with custom log devices (/dev/hwlog_dubai, /dev/hwlog_exception and /dev/hwlog_jank) that facilitate better system diagnostics through a series of ioctl

First reported Jul 27, 2022 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

About Hugo

Written in Go, Hugo is an open source static site generator available under the Apache Licence 2.0. Hugo supports TOML, YAML and JSON data file types, Markdown and HTML content files and uses shortcodes to add rich content. Other notable features are taxonomies, multilingual mode, image processing, custom output formats, HTML/CSS/JS minification and support for Sass SCSS workflows. Hugo makes use

First reported Apr 11, 2020 11:15 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2023-41112: Samsung Baseband RLC Data Re-Assembly Heap Buffer Overflow

We have identified several new heap buffer overflow vulnerabilities in Samsung’s baseband implementation (mainly used in Exynos chipsets): three different heap buffer overflows in the same function, to be precise. The most critical of these vulnerabilities can be exploited to achieve arbitrary code execution in the baseband runtime. The vulnerabilities we are disclosing in this advisory affected a

First reported Jul 29, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

VE-2026-34122: TP-Link HTTP DS stack buffer overflow

An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a stack buffer overflow, which leads to remote code execution. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in April 2026 c

First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

TVE-2026-04: TP-Link HTTP authentication bypass

An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes an authentication bypass vulnerability in the HTTP server implementation. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released was

First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2026-34121: TP-Link HTTP authentication bypass

An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes an authentication bypass vulnerability in the HTTP server implementation. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in A

First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

Full Chain Baseband Exploits, Part 3

Additional posts in this series: Part 1 Part 2 In my Basebanheimer talk at Hardwear.io, I explained a method for exploiting the Mediatek Baseband Pivot vulnerability CVE-2022-21765 for arbitrary code execution in the Linux kernel on Mediatek’s older (“Helio”) chipsets, which use 32-bit kernels. I also mentioned that using previous ideas, the vulnerability could theoretically be exploited on Mediat

First reported Dec 07, 2023 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

Now You See mi: Now You're Pwned

In this blogpost, the newest full-time member of our research team describes his internship project. If you would also like to try your hand at our hacking tools and techniques, don’t hesitate to check out our training offerings! Currently available: https://www.offensivecon.org/trainings/2026/exploiting-smartphones-through-baseband.html Last summer, I had an opportunity to join TASZK Security Lab

First reported Mar 16, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record
REPORT1 SOURCE

CVE-2026-0651: TP-Link HTTP GET path traversal

An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a path traversal which can lead to leaking secrets. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in January 2026 and update

First reported Apr 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:51 UTCOpen evidence record

The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.

A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.