to celebrate the release of Copy Fail and the professional way the embargo and disclosure was handled by all involved parties i have sacrificed my lunchbreak to do a quick C port (with aarch64 support and some other small things) of the original PoC
https://t.co/M08QEqVEwo
Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130)
https://t.co/Cbk9MBo91v
Cheers to @u1f383 for finding these CVEs + the OffensiveCon talk from gteissier & @laomaiweng for inspiration!
Linux >=6.4: epoll: UAF via race between ep_eventpoll_release() and eventpoll_release_file() because mutex_unlock() is not ownership-drop-safe https://t.co/DcPKi09sp7
What I want to know is —
Would the xz backdoor have added so much latency to startup that this race condition would be unexploitable?
Maybe Jin Tan was trying to differentially harden OpenSSH! 🙃
The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. https://t.co/uDHHSuzd5f
some people asked for the code .. so I decided to quickly refactor my scrappy paramiko script and turned it into an ssh agent implementation that works with a vanilla openssh client that has a single line patched out. https://t.co/93Y7Ha3V8N
the xz sshd backdoor rabbithole goes quite a bit deeper. I was just able to trigger some harder to reach functionality of the backdoor. there's still more to explore.. 1/n
New @Qualys#Security#Advisory!
Looney Tunables: Local Privilege Escalation in the glibc's https://t.co/dKBAL8la7D
(CVE-2023-4911)
https://t.co/SNVHiFUrxk
First big result from our new CPU research project, a use-after-free in AMD Zen2 processors! 🔥 AMD have just released updated microcode for affected systems, please update! https://t.co/NVPWFpVopz
RFC: Enforcing Bounds Safety in C (-fbounds-safety).
We have enough of important C code that we can't simply rewrite it in Rust, but we have to make it safer.
This is the most practical approach I've seen so far to improve spatial memory safety in legacy C code (that won't require new hardware features).
https://t.co/BQPINXXMjB
If you've tried using fancy semantic search tools for C, but gave up and stuck with grep... trust me, the tool you've been looking for is weggli. No setup or config needed, and it's not formal or heavyweight.
The #Qualys Research Team has discovered an easily exploitable memory corruption vulnerability (#Pwnkit) in polkit a SUID-root program that allows any unprivileged local user to gain root privileges on all major linux systems in its default configuration: https://t.co/hz74iWU7mz