Master C and C++ with our new Testing Handbook chapter

Summary: Trail of Bits added a chapter to its Testing Handbook: a security checklist for C and C++ code organized into five areas covering general bug classes, Linux usermode and kernel, Windows usermode and kernel, and seccomp/BPF sandboxes. The chapter catalogs issues such as memory safety and integer errors, libc gotchas, DLL planting and unquoted path vulnerabilities in CreateProcess, and sandbox bypasses including io_uring syscalls that execute without the BPF filter seeing them and the CLONE_UNTRACED flag that lets a tracee disable seccomp filters.
What's compelling: Trail of Bits states it still sees seccomp and BPF combinations used for sandboxing during audits and that it always uncovers a lot of issues, including bypasses like io_uring syscalls the BPF filter never sees - so a sandbox built on those older features may not be containing what you assume.

Read the original at Trail of Bits Blog ↗