Maxime Villard

being a jackass is important in life

[Maxime Villard @m00nbsd]

If you're interested in Arm64 security and VBS internals, I would suggest looking into CVE-2025-21325, quite a spectacular vulnerability @33y0re https://t.co/OGLQJmFnnr

[Connor McGarr @33y0re]

Starting 2026 with a new blog! I've really been enjoying my Windows on ARM machine - so my post is about interrupts for WoA. This includes x64/ARM differences, virtual interrupts, Hyper-V's synthetic controller, and Secure Kernel interrupts/intercepts
https://t.co/HvSbtsCtGu

[Maxime Villard @m00nbsd]

@33y0re @AlanSguigna securekernel.exe 🤫

[Microsoft Threat Intelligence @MsftSecIntel]

Read about kernel sanitizers, powerful detection features that can uncover bugs in kernel-mode components, and how they enable Microsoft engineering teams to identify and fix vulnerabilities earlier in the software development cycle: https://t.co/OYg8JCES9e

[TrendAI Zero Day Initiative @thezdi]

CVE-2022-23088: A new guest blog from @m00nbsd describes a 13-yr-old heap overflow in the Wi-Fi stack that allows network-adjacent attackers to execute code on affected installations of FreeBSD Kernel. Includes root cause & PoC. Read the details at https://t.co/NPHu6jkiaa

[Maxime Villard @m00nbsd]

Remote kernel heap overflow in the PlayStation 5: https://t.co/eqGRj3sSp9

[Maxime Villard @m00nbsd]

Kernel RCE in #FreeBSD via WiFi frames: https://t.co/GCw2f9HdV5

Also affects #pfSense / #OPNsense / etc

[Maxime Villard @m00nbsd]

SMAP bypass in the PlayStation 5: https://t.co/di96hx1H9M

[Maxime Villard @m00nbsd]

Dudes, you don't seem to have noticed there are some nicer big-ass vulns in that hypervisor. This one for example, host stack r/w overflow, full VM escape, and no, retguard does not mitigate it. #OpenBSD

[OpenBSD src Changes @OpenBSD_src]

OPENBSD_6_9 bluhm@ modified usr.sbin/vmd/virtio.c: vmd guests can trigger excessive log messages on the host by sending certain network packets. this is errata/6.9/001_vmd.patch.sig

[Maxime Villard @m00nbsd]

@AlwaysCurious__ @openbsdnow Indeed, and there were also other remote kernel vulns over the last few years that qualified as well.

But whatever -- #OpenBSD's slogan is known to be fraudulent.

[Maxime Villard @m00nbsd]

@NedWilliamson @esizkur XNU has a pullup in IP6_EXTHDR_CHECK so yes there's a possible uaf, but conditional so not interesting imho

[Maxime Villard @m00nbsd]

The recent ICMPv6 stuff in Windows reminded me I still had similar BSD vulns in my garage, so here we go

Remote use-after-free in #OpenBSD via ICMPv6: https://t.co/CaFcAgG3Rf

Remote use-after-free in #FreeBSD via ICMPv6: https://t.co/PpvVi2HdiC

RCE possible in the first one.

[Maxime Villard @m00nbsd]

@AlwaysCurious__ @ZvenLin late answer -- shouldn't be difficult

[Maxime Villard @m00nbsd]

Trivial VM escape in #Bhyve: if you're a guest, allocate a GPA, use a VMLOAD+RDMSR probe to determine its HPA, use SKINIT to reinit the CPU core at that HPA. The CPU core restarts and executes your instructions in host mode. That's it, you're the host.

[TrendAI Zero Day Initiative @thezdi]

A new guest blog with an excellent analysis from @m00nbsd shows a fast and smooth privilege escalation exploit in #FreeBSD. His write-up includes PoC and a video demo. Read the details at https://t.co/Vy9gwIPYc6

[Maxime Villard @m00nbsd]

I guess I should one day publish my "NetBSD Privileged Kernel" research on #NetBSD, here for example running the motherboard's SMM in a container to protect the kernel from firmware vulns and backdoors

[Maxime Villard @m00nbsd]

reversing your bios is fun and all, until you realize there's a bugdoor in it

[Maxime Villard @m00nbsd]

excuse me, do you have a moment to talk about uninitialized kernel memory

[Maxime Villard @m00nbsd]

this one was real twisted though #OpenBSD

[Maxime Villard @m00nbsd]

cleaning up my garage I came across an old kernel bug I had found in OSX, looks like the latest MacOS is still affected

[Maxime Villard @m00nbsd]

some complicated remote read overflow in #FreeBSD - looks hardly exploitable, mmh