googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Google Project Zero used the Domato grammar fuzzing engine to find three new VBScript vulnerabilities, all now fixed, after at least two VBScript 0day attacks (CVE-2018-8174 and CVE-2018-8373) were delivered through Microsoft Office files in 2018. The bugs...
Project Zero researcher Natalie Silvanovich reviewed seven Android messaging and mail apps and found three directory traversal vulnerabilities, in Gmail, Outlook and Telegram, all tied to attachment names containing special characters during download. She...
Google Project Zero's James Forshaw documented a mismatch in Windows debugging: the Win32 DebugActiveProcess API opens a target process with PROCESS_CREATE_THREAD, PROCESS_VM_OPERATION, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION and...
Project Zero's Natalie Silvanovich investigated the iPhone's fully remote, interaction-less attack surface across SMS, MMS, Visual Voicemail, Email and iMessage, and found several serious vulnerabilities. She identified CVE-2019-8613, a use-after-free of...
Project Zero's Natalie Silvanovich reported CVE-2019-8646, an iMessage flaw introduced in iOS 12.1 in which the unsafe class _NSDataFileBackedFuture can be deserialized remotely, letting an attacker read files and leak memory. She chained it with the...
Project Zero announced that starting January 1, 2020, it will hold all vulnerability details until Day 90 regardless of when a vendor fixes the bug, replacing its prior practice of disclosing at patch time or at researcher discretion. The team said 97.7%...
Project Zero's Samuel Groß fuzzed Apple's ImageIO framework, which parses images on interactionless code paths in popular messenger apps, and found multiple vulnerabilities that were reported to Apple or the relevant open source maintainers and...
Google Project Zero's Brandon Azad published a reference cataloging public iOS kernel exploits from local app context across iOS 10 through iOS 13, tracing each from the vulnerability's initial primitive to kernel read/write. The post covers exploits...
Project Zero's Natalie Silvanovich detailed two WebRTC RTP extension bugs, CVE-2020-6389 and CVE-2020-6387, both introduced in extensions implemented in WebRTC in 2019, and tested whether they were exploitable in popular Android messaging applications....
Project Zero's Natalie Silvanovich, in Part 2 of a three-part series published August 5, 2020, found CVE-2020-6514, a WebRTC bug that sends the memory location of the SctpTransport object to the remote peer during every SCTP connection, and a...
Project Zero's Mateusz Jurczyk published the fifth and final post in a series on a zero-click MMS exploit against Samsung flagship devices, chaining a Qmage codec buffer overflow into an ASLR oracle that leaks memory through MMS delivery reports. He found...
Google Project Zero announced a USD $50,000 pilot program awarding up to USD $5,000 in Google Compute Engine credits per accepted proposal for research into JavaScript engine fuzzing, running from Oct 1, 2020 to Oct 1, 2021. Applicants must fuzz...
Project Zero's Natalie Silvanovich built a Frida-based exploit for WebRTC vulnerabilities on Android and tested it against 14 conferencing apps narrowed from roughly 200 that use WebRTC, finding it worked on Signal about 90% of the time and also on Google...
Google Project Zero's Mateusz Jurczyk published a second post in the "One font vulnerability to rule them all" series, showing how the ATMFD.DLL font interpreter's "blend" operator flaw could be exploited to achieve arbitrary code execution in Adobe Reader...
Google Project Zero's Mateusz Jurczyk detailed how the BLEND PostScript operator vulnerability in ATMFD.DLL can be reached from Adobe Reader's renderer process and used to escape the sandbox on 32-bit Windows 8.1. Because AddFontResource is blocked in the...
Google Project Zero's Ian Beer detailed a locking bug in the XNU virtual memory subsystem where vm_map_copyin_internal drops and retakes the source map lock, letting two threads both apply the optimized move to the same anonymous vm_map_entry and create...
Project Zero's review of 2020 found 24 0-days exploited in-the-wild, and 6 of them were closely related to previously disclosed vulnerabilities, some requiring only a line or two of code to change. The same threat actor exploited the same JScript...
Google Project Zero's Samuel Groß published a tool that runs arbitrary iOS binaries and libraries natively on Apple Silicon Macs, exploiting the shared arm64 ISA, macOS's compatible runtime libraries, and /System/iOSSupport. Launching an iOS binary...
Google Project Zero's Felix Wilhelm published the first public writeup of a KVM guest-to-host escape that does not rely on user space components such as QEMU, exploiting CVE-2021-29657 in KVM's AMD-specific nested virtualization code. The bug affects...
Google Project Zero's Jann Horn documented a Linux kernel locking bug in the tiocspgrp ioctl handler, where the lock is taken on the tty pointer while the pgrp member of real_tty is modified, allowing concurrent TIOCSPGRP calls on both ends of a...
Google Project Zero's Tavis Ormandy disclosed CVE-2021-43527, a missing bounds check in Mozilla's NSS cryptography library where an oversized digital signature is copied into a fixed-size VFYContext buffer, causing memory corruption across multiple...
Google Project Zero researcher Natalie Silvanovich reported two Zoom vulnerabilities, a buffer overflow affecting both Zoom clients and MMR servers and an info leak useful only to attackers on MMR servers, both fixed on November 24, 2021. The buffer...
Project Zero guest author Stephen Röttger demonstrated that RIDL and other MDS hardware vulnerabilities can leak Mojo port names across process boundaries, letting a compromised Chrome renderer send messages to privileged IPC interfaces and read arbitrary...
Project Zero's Jann Horn documented a memory corruption bug in Samsung's Android kernel for the Galaxy A50 (A505FN), caused by logic issues in Samsung's PROCA process-authentication subsystem combined with a race condition in its locking. A second...
Google Project Zero researchers Sergei Glazunov and Mark Brand describe a Chrome for Android heap-buffer-overflow that ClusterFuzz caught with a two-line test-case loading example.com and example.net, then stopped reproducing. The ASAN trace showed a write...
Project Zero disclosed crbug.com/944062, a TurboFan vulnerability in Chrome's JavaScript compiler found independently by Samuel (saelo@) via fuzzing with fuzzilli and by Stephen Röttger via manual code auditing, fixed in beta before reaching stable Chrome....
Google Project Zero's Ivan Fratric analyzed an externally reported stack-based buffer overflow in the Skia graphics library, which is used by Chrome, Firefox and Android, and found the trigger was a malformed RRect with tiny radius values that produced a...
Google Project Zero researcher Brandon Azad examined Apple's Pointer Authentication implementation on the A12 SoC in the iPhone XS and demonstrated using an arbitrary kernel read/write primitive to forge kernel PAC signatures for the A keys, sufficient to...
Brandon Azad of Google Project Zero described CVE-2019-6225, a MIG reference counting vulnerability in XNU's task_swap_mach_voucher() function that he exploited on iOS 12.1.2 to build a fake kernel task port with read and write access to arbitrary kernel...
Jann Horn of Google Project Zero disclosed CVE-2018-18281, a Linux kernel bug in which mremap()'s move_ptes() releases a page reference before the TLB flush on the old address range, leaving a race window in which another task can free the page. On kernels...