Graham Sutherland

Summary: Trail of Bits published a walkthrough of its solutions to two C/C++ security challenges from a new Testing Handbook chapter: a Linux ping program with an inet_ntoa global buffer gotcha and command injection, and a Windows driver with registry type confusion bugs that escalate from local denial of service to a kernel write primitive. The same chapter, released April 09, 2026, provides a security checklist for C and C++ code review covering Linux, Windows, and seccomp environments.
What's compelling: The Windows driver case shows a local denial-of-service bug in registry handling escalating into a kernel write primitive, the kind of flaw that turns a low-severity finding into full system compromise.

Read the original at Trail of Bits Blog ↗