Zero Day Engineering | Community & Industry

Zero Day Engineering Supplies • Private Intelligence: @zerodayalpha • Community:

[Zero Day Engineering | Community & Industry @zerodayengine]

Welcome to Zero Day Engineering Links

Topics:
• vulnerability research
• reverse engineering
• system internals
• exploit engineering

We select, feature and comment mature, original, top quality community research and code which has a clear impact and practical applications

[Zero Day Engineering | Community & Industry @zerodayengine]

Analysis of VMware vCenter heap overflow vulnerability exploited at Matrix Cup competitions in China, June 2024 (CVE-2024-38812):

https://t.co/JsK3H1Cpof

Another one in same code, 2023:

https://t.co/jiTT2JVnqK

** Both are RCE to management console, not a hypervisor VM escape!

[Zero Day Engineering | Community & Industry @zerodayengine]

Interestingly, the elevation of privilege part of the chain is still not known

Tracker issue🔒 https://t.co/psqOfVIcR9

[Zero Day Engineering | Community & Industry @zerodayengine]

[Browser Exploitation] Insightful little analysis of v8 CVE-2024-7965: https://t.co/YE3ZZjoxzj
PoC: https://t.co/0dZk7VdrTb

Logic bug in Turbofan's "sea of nodes" IR implementation allows for OOB array access!

Exploit in-the-wild reported by Google & CISA on 26th August 2024

[Alisa Esage Шевченко @alisaesage]

Slides: "Fuzzing from First Principles": https://t.co/FXPbtA5uST

I heard that the podcast reached all-time-highest number of viewers, thank you for coming to see me!

[xvonfers @xvonfers]

(CVE-2024-3914)[330759272][Pwn2Own 2024][DOMArrayBuffer]DOMArrayBuffer confused about ownership of backing buffer -> UAF is now open with PoC and exploit
https://t.co/IXUhYqbqwJ

PoC:
https://t.co/PREUW9sEpi
Exploit:
https://t.co/0DBGY6yCxI
WP:
https://t.co/78iNyjthTe

@0x10n

[Zero Day Engineering | Community & Industry @zerodayengine]

Short and to the point, patch analysis + PoC of Windows Kernel ntoskrnl LPE bug (CVE-2024-38106), by @b1thvn_: https://t.co/1hAadYoZhx

This bug is being exploited in-the-wild, as part of a browser exploit chain with Chrome v8 RCE (CVE-2024-7971), reported in August 2024

[Zero Day Engineering @zerodayalpha]

0-Day Insights - Deep Dive: Qualcomm MSM Linux Kernel & ARM Mali GPU 0-day Exploit Attacks of October 2023 https://t.co/CgfPVvrxch (by @alisaesage)

[Zero Day Engineering | Community & Industry @zerodayengine]

Tracking bug for v8 the_hole bug class mitigations https://t.co/bXxpXnyS88

[Zero Day Engineering @zerodayalpha]

Research insights on recent Chrome 0day in Skia (CVE-2023-6435) from our lab:

1. The bug is an integer overflow in Skia, an open source library for rendering 2D graphics which which is used in Chromium backend.

2. The bug can be used to escape browser sandbox in Chrome app on Android.

3. At least one more bug -in one of the renderer subsystems, such as v8- is required to complete the attack with a full chain exploit. Google did not disclose the other bug at this time.

4. The bug cannot be used to achieve a full sandbox escape on common desktop deployments of Google Chrome.

5. Based on the above, we hypothesize that the original 0day attack vector and the exploit chain was targeting Android devices specifically.

6. The bug seems to be available and reachable in broad-scope Chromium (including common desktop deployments of Chrome browser), but an additional 3rd vulnerability would be required to execute arbitrary code with the same level of privilege as in the original 0day attack in most popular deployment configurations. Therefore, overal impact of the bug is somewhat scoped.

7. The bug will strongly affect Chrome embedders which use unsandboxed GPU process. We did not look further into this, but Chrome-based systems such as electron framework and derivatives should be patched quickly.

8. The bug is not explicitly related to the previous 0day in Skia (CVE-2023-2136).
I.e. it's not a patch bypass of the latter, and not located in the same subsystem of code.

9. Both bugs (6435 and 2136) are focused on bypassing in-code checks, which implicitly suggests the same specialized bughunting workflow, and therefore, possibly the same attacker.

10. The bug is not very trivial to reproduce. Strong familiarity with GPU-level graphics internals is required.

Chrome release notes: https://t.co/vZFC97NPhd
Patchset: https://t.co/UnEAfIvtAw
Issue tracker (restricted): https://t.co/eCL5V2AWYT

Analysis by @alisaesage

[Zero Day Engineering | Community & Industry @zerodayengine]

Chromium [WIP] internal fuzzing map by source code directory, official dashboard https://t.co/pa6iSgKvKs

[Zero Day Engineering | Community & Industry @zerodayengine]

Excellent high-level exposure of chromium mojo system internals, apparently the author is one of the chromium internal team (links to google-private docs included)

[Zero Day Engineering | Community & Industry @zerodayengine]

Chromium Mojo & IPC internals https://t.co/KcQXq9i7dP by keyou (in Chinese)

[Zero Day Engineering | Community & Industry @zerodayengine]

List of Chromium security bugs (with technical details) that received top bounty rewards from Google VRP: https://t.co/OgeRR1g2NE Congrats to bug finders!

[Zero Day Engineering | Community & Industry @zerodayengine]

@maddiestone @_clem1 Root cause analysis of the patch:

[Alisa Esage Шевченко @alisaesage]

Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)

[Zero Day Engineering | Community & Industry @zerodayengine]

@CISACyber Root cause analysis of the patch:

[Alisa Esage Шевченко @alisaesage]

Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)

[Zero Day Engineering | Community & Industry @zerodayengine]

@hosselot See also:

[Alisa Esage Шевченко @alisaesage]

Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)

[Zero Day Engineering | Community & Industry @zerodayengine]

@buptsb See also:

[Alisa Esage Шевченко @alisaesage]

Looked at security patch for CVE-2023-3079, the latest zero day exploit for Chrome/v8 (JavaScript), patched in v114.0.5735.106-110. My quick reverse engineering notes in thread (root cause analysis)