Welcome to Zero Day Engineering Links
Topics:
• vulnerability research
• reverse engineering
• system internals
• exploit engineering
We select, feature and comment mature, original, top quality community research and code which has a clear impact and practical applications
Analysis of VMware vCenter heap overflow vulnerability exploited at Matrix Cup competitions in China, June 2024 (CVE-2024-38812):
https://t.co/JsK3H1Cpof
Another one in same code, 2023:
https://t.co/jiTT2JVnqK
** Both are RCE to management console, not a hypervisor VM escape!
[Browser Exploitation] Insightful little analysis of v8 CVE-2024-7965: https://t.co/YE3ZZjoxzj
PoC: https://t.co/0dZk7VdrTb
Logic bug in Turbofan's "sea of nodes" IR implementation allows for OOB array access!
Exploit in-the-wild reported by Google & CISA on 26th August 2024
Slides: "Fuzzing from First Principles": https://t.co/FXPbtA5uST
I heard that the podcast reached all-time-highest number of viewers, thank you for coming to see me!
(CVE-2024-3914)[330759272][Pwn2Own 2024][DOMArrayBuffer]DOMArrayBuffer confused about ownership of backing buffer -> UAF is now open with PoC and exploit
https://t.co/IXUhYqbqwJ
PoC:
https://t.co/PREUW9sEpi
Exploit:
https://t.co/0DBGY6yCxI
WP:
https://t.co/78iNyjthTe
@0x10n
Short and to the point, patch analysis + PoC of Windows Kernel ntoskrnl LPE bug (CVE-2024-38106), by @b1thvn_: https://t.co/1hAadYoZhx
This bug is being exploited in-the-wild, as part of a browser exploit chain with Chrome v8 RCE (CVE-2024-7971), reported in August 2024
0-Day Insights - Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023 https://t.co/CgfPVvrxch (by @alisaesage)
Research insights on recent Chrome 0day in Skia (CVE-2023-6435) from our lab:
1. The bug is an integer overflow in Skia, an open source library for rendering 2D graphics which which is used in Chromium backend.
2. The bug can be used to escape browser sandbox in Chrome app on Android.
3. At least one more bug -in one of the renderer subsystems, such as v8- is required to complete the attack with a full chain exploit. Google did not disclose the other bug at this time.
4. The bug cannot be used to achieve a full sandbox escape on common desktop deployments of Google Chrome.
5. Based on the above, we hypothesize that the original 0day attack vector and the exploit chain was targeting Android devices specifically.
6. The bug seems to be available and reachable in broad-scope Chromium (including common desktop deployments of Chrome browser), but an additional 3rd vulnerability would be required to execute arbitrary code with the same level of privilege as in the original 0day attack in most popular deployment configurations. Therefore, overal impact of the bug is somewhat scoped.
7. The bug will strongly affect Chrome embedders which use unsandboxed GPU process. We did not look further into this, but Chrome-based systems such as electron framework and derivatives should be patched quickly.
8. The bug is not explicitly related to the previous 0day in Skia (CVE-2023-2136).
I.e. it's not a patch bypass of the latter, and not located in the same subsystem of code.
9. Both bugs (6435 and 2136) are focused on bypassing in-code checks, which implicitly suggests the same specialized bughunting workflow, and therefore, possibly the same attacker.
10. The bug is not very trivial to reproduce. Strong familiarity with GPU-level graphics internals is required.
Chrome release notes: https://t.co/vZFC97NPhd
Patchset: https://t.co/UnEAfIvtAw
Issue tracker (restricted): https://t.co/eCL5V2AWYT
Analysis by @alisaesage
Excellent high-level exposure of chromium mojo system internals, apparently the author is one of the chromium internal team (links to google-private docs included)
List of Chromium security bugs (with technical details) that received top bounty rewards from Google VRP: https://t.co/OgeRR1g2NE Congrats to bug finders!
Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)
Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)
Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)
Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)