googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Google announced Project Zero on July 15, 2014, a well-staffed team of security researchers working 100% of their time on improving security across the Internet, following part-time research that led to discoveries such as Heartbleed. The team commits to...
Ian Beer details how he achieved code execution inside Safari's renderer sandbox at the pwn4fun contest at CanSecWest in March 2014 by exploiting an integer overflow in JavaScriptCore's JSStringJoiner class. The bug stemmed from an incomplete patch that...
Google Project Zero published technical details of Apple bugs roughly a month after Apple released two security advisories fixing them, timing the release to give users time to patch. The disclosed bugs include heap corruptions in launchd, which runs...
Apple released OS X 10.9.5 and iOS 8, fixing a set of sandbox escapes and privilege escalation bugs found by Project Zero, most located through manual source code auditing and binary analysis. The bugs included a kernel ASLR bypass on OS X reachable from...
Google Project Zero's November 2014 Patch Tuesday roundup details bugs reported by its members, including two Internet Explorer sandbox escapes found by James Forshaw, three Microsoft Office memory corruption vulnerabilities found by Ben Hawkes, Flash...
Project Zero's Mark Brand documented CVE-2015-0318, a bug in the PCRE regex engine as used in Flash, where the \c escape sequence combined with a multibyte UTF-8 character compiles into invalid PCRE bytecode. By adding a back-reference, the invalid opcode...
Project Zero's Chris Evans described a 2014-fixed Flash vulnerability (issue 122) in which the G711 sound codec is broken on some platforms and always produces a wild copy, triggering a heap memmove() with a small negative length. The exploit uses...
Project Zero's Mark Brand found that Chrome's IOBuffer constructor takes an int for buffer_size while CertificateResourceHandler sums certificate chunks in a size_t content_length_, so a certificate declaring a length like 0x100001000 bytes gets truncated...
Project Zero's Natalie Silvanovich documented 24 ECMAScript redefinition vulnerabilities found in Adobe Flash over a few months, where native code assumes a function or variable behaves a certain way but the language allows it to be redefined. The post...
Project Zero's Chris Evans documented three ways to bypass Adobe's Flash Vector.<*> length-checking mitigation, which XORs the length with a secret cookie fetched through a pointer stored in the Vector header. The bypasses - heap spraying in a 32-bit...
Project Zero's Mark Brand published a working exploit for CVE-2015-3864, a libstagefright flaw in Android's handling of 'tx3g' chunks in MPEG4 files, demonstrating it on Android 5.0+ on a Nexus 5. The September patch checked chunk_size against SIZE_MAX but...
Project Zero researchers spent one week testing a Samsung Galaxy S6 Edge in a five-versus-five team contest and found 11 high-impact security issues, including a directory traversal bug (CVE-2015-7888) that writes a file as system and an email client flaw...
Project Zero's Natalie Silvanovich analyzed how Adobe's Isolated Heap, which partitions Flash's MMgc heap into three areas to separate objects likely to contain corruption bugs from objects useful for exploiting them, affected exploitability of two bugs...
Google Project Zero announced the Project Zero Prize on 2016-Sep-13, a contest to find a vulnerability or bug chain achieving remote code execution on multiple Android devices knowing only the devices' phone number and email address. Prizes are $200,000...
Project Zero's Ian Beer described a design flaw in the XNU kernel behind iOS and macOS in which IOKit user clients store an owningTask pointer without taking a reference, leaving a dangling task_t that can be reused by a privileged process after the...
Google's Project Zero Prize, announced September 13, 2016, concluded with no prizes awarded after receiving no valid entries or bugs; everything submitted was spam or did not resemble a contest entry. Project Zero attributed the outcome to the difficulty...
Google Project Zero's Mateusz Jurczyk reports that fuzzing the user-mode Windows Uniscribe library (usp10.dll) in late 2016 produced 8 high-severity issues that could allow remote code execution, all but one reachable through a standard DrawText call and...
Project Zero's Ivan Fratric built a generative DOM fuzzer called Domato, gave each of five major browsers roughly 100,000,000 iterations, and found 31 security bugs in currently shipping versions. Apple Safari's WebKit accounted for 17 of them, against 2...
With the Windows 10 Creators Update, Microsoft introduced Arbitrary Code Guard in Microsoft Edge, which blocks allocating new executable memory or modifying existing executable memory in a Content Process. Because JIT compilation of JavaScript is...
Project Zero's Mateusz Jurczyk published a whitepaper on detecting kernel memory disclosure, describing Bochspwn Reloaded, a dynamic binary instrumentation tool built on the Bochs IA-32 software emulator. The project found and reported over 70 previously...
Google Project Zero reviewed the WebAssembly implementations in all four major browsers and found three vulnerabilities, most occurring during the module parsing phase. The bugs include CVE-2018-4222, a double-added offset in WebKit's TypedArray handling...
Project Zero's Jann Horn described a chain that let a malicious USB device take over a locked Android phone, tested on a Pixel 2, by exploiting two bugs fixed as CVE-2018-9445 (patch level 2018-08-01) and CVE-2018-9488 (patch level 2018-09-01). The first...
Google Project Zero's Jann Horn described exploiting CVE-2018-17182, a Linux kernel bug present since version 3.16, in which 32-bit sequence numbers used to invalidate per-thread VMA caches could overflow and let a thread reuse freed VMA pointers. Fixes...
Google Project Zero's Ivan Fratric reran the same Domato DOM fuzzer used a year earlier for 100,000,000 iterations against WebKitGTK+ 2.20.2 and reported 9 unique bugs to Apple, 6 of which affected the release version of Safari 11.1.2. All 9 were fixed by...
Google Project Zero's Ian Beer revisited CVE-2014-4461, a kernel bug in IOSharedDataQueue that Pangu Team exploited in the Pangu 7 jailbreak for iOS 7.1-7.1.x released June 23 2014, and combined it with a similar new issue to build what he calls a...
Project Zero's Mark Brand detailed two Chrome SwiftShader vulnerabilities, a precision-related information leak that returns 0x10000 bytes past a 0xb620000-byte texture allocation, and a use-after-free of an egl::ImageImplementation object caused by a...
Project Zero's Natalie Silvanovich fuzzed WebRTC, the video conferencing implementation used by Chrome, Safari, Firefox, Facebook Messenger and Signal, and found seven vulnerabilities, including CVE-2018-6156, a large overflow in forward error correction...
Project Zero's Natalie Silvanovich fuzzed WhatsApp's video calling, which uses PJSIP rather than WebRTC, by hooking the memcpy that copies packets just before encryption and redirecting it to a custom fuzzing library loaded via dlopen. The setup produced a...
Project Zero's Natalie Silvanovich spent extensive effort reviewing WhatsApp call signalling in 2018 looking for a remote, interaction-less vulnerability, and found none. She built a modified APK that intercepted and altered peer-to-peer and peer-to-server...
Google Project Zero's Natalie Silvanovich reported finding 11 bugs across WebRTC, FaceTime and WhatsApp, most through less than 15 minutes of mutation fuzzing RTP. She noted WebRTC lacked documented vulnerability reporting and integrator security guidance,...