Richard van Eeden

Program received signal SIGSEGV, Segmentation fault. 0xbade5dee in ?? ()

[blasty @bl4sty]

to celebrate the release of Copy Fail and the professional way the embargo and disclosure was handled by all involved parties i have sacrificed my lunchbreak to do a quick C port (with aarch64 support and some other small things) of the original PoC

https://t.co/M08QEqVEwo

[The Hacker's Choice (@[email protected]) @hackerschoice]

😍RELEASE: The TEAM-TESO cvs: https://t.co/CHwPgpcXGr

All exploits, advisories, teso-informationals (never released), burneye, bscan, ... plus some rare pictures.

Enjoy & Keep hacking.

Yours Sincerely,
Team-Teso (via THC's twitter account).

[Crusaders of Rust @cor_ctf]

Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130)

https://t.co/Cbk9MBo91v

Cheers to @u1f383 for finding these CVEs + the OffensiveCon talk from gteissier & @laomaiweng for inspiration!

[Project Zero Bugs @ProjectZeroBugs]

Linux >=6.4: epoll: UAF via race between ep_eventpoll_release() and eventpoll_release_file() because mutex_unlock() is not ownership-drop-safe https://t.co/DcPKi09sp7

[blasty @bl4sty]

ok ok fine, for old time's sake
https://t.co/eJnUdUcGzf

[raptor @0xdea]

CVE-2024-29510 – #Exploiting #Ghostscript using format strings 💚

https://t.co/KiAiUpGK9N

[thaddeus e. grugq @thegrugq]

What I want to know is —
Would the xz backdoor have added so much latency to startup that this race condition would be unexploitable?

Maybe Jin Tan was trying to differentially harden OpenSSH! 🙃

[Qualys @qualys]

The award-winning Qualys Threat Research Unit (TRU) has discovered a critical vulnerability in OpenSSH, designated CVE-2024-6387 and aptly named "regreSSHion." This Remote Code Execution bug grants full root access, posing a significant exploitation risk. https://t.co/uDHHSuzd5f

[raptor @0xdea]

Qualys does it again!

#regreSSHion: #RCE in #OpenSSH's server, on glibc-based #Linux systems
(CVE-2024-6387)

https://t.co/iJufmfql5g

[blasty @bl4sty]

some people asked for the code .. so I decided to quickly refactor my scrappy paramiko script and turned it into an ssh agent implementation that works with a vanilla openssh client that has a single line patched out. https://t.co/93Y7Ha3V8N

[blasty @bl4sty]

the xz sshd backdoor rabbithole goes quite a bit deeper. I was just able to trigger some harder to reach functionality of the backdoor. there's still more to explore.. 1/n

[Open Source Security mailing list @oss_security]

Backdoor in upstream xz/liblzma leading to ssh server compromise https://t.co/29Vfiz0n1T

[raptor @0xdea]

New @Qualys #Security #Advisory!

Looney Tunables: Local Privilege Escalation in the glibc's https://t.co/dKBAL8la7D
(CVE-2023-4911)

https://t.co/SNVHiFUrxk

[Thorsten Holz @thorstenholz]

One of my favorite posters at @USENIXSecurity this year - https://t.co/fMTjCWgdNr is an actual implementation in this direction 🤪 #usesec23

[Tavis Ormandy @taviso]

First big result from our new CPU research project, a use-after-free in AMD Zen2 processors! 🔥 AMD have just released updated microcode for affected systems, please update! https://t.co/NVPWFpVopz

[Qualys @qualys]

The Qualys Threat Research Unit (TRU) has discovered a remote code execution vulnerability in OpenSSH’s forwarded ssh-agent. https://t.co/CPRUxWXCs6

[Kostya Serebryany @kayseesee]

RFC: Enforcing Bounds Safety in C (-fbounds-safety).

We have enough of important C code that we can't simply rewrite it in Rust, but we have to make it safer.

This is the most practical approach I've seen so far to improve spatial memory safety in legacy C code (that won't require new hardware features).

https://t.co/BQPINXXMjB

[Richard van Eeden @0xbade5dee]

@_luism @justine_osborne Congratulations!!!!

[Tavis Ormandy @taviso]

If you've tried using fancy semantic search tools for C, but gave up and stuck with grep... trust me, the tool you've been looking for is weggli. No setup or config needed, and it's not formal or heavyweight.

[Qualys @qualys]

The #Qualys Research Team has discovered an easily exploitable memory corruption vulnerability (#Pwnkit) in polkit a SUID-root program that allows any unprivileged local user to gain root privileges on all major linux systems in its default configuration: https://t.co/hz74iWU7mz