CVE-2024-13745 in EDK II (likely, "WONTFIX"): "what you measure is not what you use".
The story about firmware measuring bytes different from ones being used. It affects PCR[5], so the severity is low (nobody cares about PCR[5] by default).
https://t.co/K09lww7uR9
The vendor reported that this issue has been fixed in 14.1-60.52.
No security advisory, CVE ID, release notes entry was published. Although this is a minor vulnerability, it is a vulnerability. 2/2
NotCVE-2026-0002: if you run two NetScalers in the high availability (HA/HA-INC) deployment, no SSH host key checks are performed between them, even when you followed every advice listed here: https://t.co/V5M7nz1Xsv (see: Set up secure communication between peer appliances) 1/2
@matrosov A similar story: putting disclosed vulnerabilities under "embargo" (no security advisory is posted before some insane deadline, although everything is public already).
My long post about wide-block & AEAD modes in full-disk encryption: it cover threat models, vulnerabilities, and edge cases.
Key points:
- It's common for FDE implementations to fail outside of the encryption layer.
https://t.co/ze4H8jBF48
1/4
directory entries).
- Defusing the Elephant diffuser: injecting a bunch of null bytes into the BitLocker-encrypted volume (AES-CBC with Elephant diffuser). An interesting but unexploitable bug present since Vista. 3/4
Unfortunately, this paper from 2017 is still relevant.
https://t.co/UH7MZpi1Cl
1. BestCrypt Volume Encryption (BCVE) allows watermarking attacks.
2. BCVE allows plaintext injection attacks.
3. BCVE allows forced decryption of some sectors.
1/5
The third attack allows adversaries to remotely force the decryption of some sectors (like those belonging to a database used by a web-facing application) through spraying (repeatedly causing the INSERT operation of) a specific 16-byte pattern.
4/5
(A new class of symlink attacks is mentioned below.)
According to Microsoft (MSRC), attacks involving symlinks stored on removable drives or in file system images (like VHDX) are not vulnerabilities.
If an unprivileged user manages to quickly replace a regular file... 1/7
@wdormann Test setup: .vhdx containing .7z containing .exe.
Test #1: open .vhdx in 7-Zip, navigate to .7z inside that container, extract .exe. Result: MotW present.
Test #2: mount .vhdx using Explorer, open .7z inside the mount point, extract .exe. Result: MotW absent.