googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Google Project Zero and the Google Cloud security team released a technical report on a security review of the AMD Secure Processor (ASP), the isolated ARM processor in AMD EPYC CPUs that provides a root of trust and controls secure system initialization....
Google Project Zero's Maddie Stone traced CVE-2022-22620, a Safari use-after-free that Apple first fixed in 2013, was reintroduced in December 2016 during refactoring, and was disclosed as exploited in the wild in January 2022. The 2016 commit changed the...
Google Project Zero reported that as of June 15, 2022, there had been 18 0-days detected and disclosed as exploited in the wild in 2022, and that at least nine of them are variants of previously patched vulnerabilities. Four of the 2022 0-days are variants...
Project Zero researchers Ivan Fratric, Thomas Dullien, James Forshaw and Steven Vittitoe found seven JScript vulnerabilities in jscript.dll, five of which can be triggered through WPAD/PAC on Windows 10, where every machine queries the local network via...
Google Project Zero's Gal Beniamini completed a chain that achieved remote kernel code execution on the iPhone 7 over Wi-Fi alone, building on a prior Wi-Fi firmware exploit to take control of the XNU kernel. The post identifies seven vulnerabilities in...
Google Project Zero disclosed that CPU data cache timing can be abused to leak information out of mis-speculated execution, yielding at worst arbitrary virtual memory reads across local security boundaries on certain Intel, AMD and ARM processors. Jann...
Google Project Zero's Mateusz Jurczyk used binary diffing of decompiled Windows 7, 8.1 and 10 kernels to count memset calls in top-level syscall handlers, finding 8 ntoskrnl and 16 win32k syscall handlers in Windows 7 with new memset usage versus Windows...
Google Project Zero researcher Gal Beniamini reverse-engineered the Broadcom Wi-Fi firmware on the iPhone 7, uncovered several vulnerabilities, and developed a working exploit that achieved code execution on the Wi-Fi chip plus a covert backdoor allowing...
Project Zero's James Forshaw documented a Windows kernel logic bug class in which the IO Manager's access mode handling can mismatch security access checking and memory access checking, with maximum impact of local privilege escalation if kernel and driver...
Google Project Zero's James Forshaw demonstrated injecting arbitrary code into a full Protected Process at WindowsTCB level without administrator privileges, after his earlier technique only reached PPL-WindowsTCB. He found that WerFaultSecure.exe and...
Project Zero's James Forshaw detailed a technique for exploiting arbitrary file writes on Windows 10 to gain local elevation of privilege, using the Microsoft Diagnostics Hub Standard Collector Service (DiagHub) to load an arbitrary DLL from SYSTEM32. He...
Project Zero's Gal Beniamini analyzed the two major Android TrustZone TEEs, Qualcomm's QSEE and Trustonic's Kinibi, finding that these secure operating systems lag behind modern operating systems in security mitigations and practices. He identified a...
Project Zero's Andrey Konovalov found CVE-2017-7308, a signedness bug in the Linux kernel's packet_set_ring() function that lets a crafted PACKET_RX_RING option on an AF_PACKET socket with a TPACKET_V3 ring buffer bypass a sanity check and cause an...
Project Zero's Ian Beer documented CVE-2017-2370, a heap buffer overflow in the mach_voucher_extract_attr_recipe_trap mach trap added in iOS 10, where a copy-paste error left copyin reading a userspace pointer as the copy length instead of the validated sz...
Project Zero's James Forshaw detailed how Issue 1550 lets a normal user create an arbitrary object manager directory as SYSTEM, because the AppInfo service calls CreateAppContainerToken without impersonating the user, and the user can plant a symbolic link...
Project Zero's James Forshaw described three now-fixed methods for bypassing Oracle VirtualBox's Windows process hardening and injecting arbitrary code into its protected processes. The hardening uses kernel callbacks to limit handle access and user-mode...
Project Zero's Gal Beniamini showed that after gaining code execution on Broadcom's Wi-Fi SoC, an attacker can revert Broadcom's is_wlc_event_frame validation patch in firmware RAM and inject arbitrary frames into the host driver's event channel, which...
Project Zero's Jann Horn reported a Xen bug on 2017-03-14 that lets an attacker controlling the kernel of a paravirtualized x86-64 guest break out of the hypervisor and gain full control of the machine's physical memory; Xen released an advisory and patch...
Project Zero's Gal Beniamini found vulnerabilities in Broadcom's FullMAC Wi-Fi SoC firmware that allow remote code execution on the chip, demonstrated on a fully updated Nexus 6P running Android 7.1.1 NUF26K. The affected chips appear in the Nexus 5, 6 and...
Google Project Zero's Gal Beniamini detailed multiple vulnerabilities that let an attacker subvert each of Real-Time Kernel Protection's security mechanisms, the Samsung KNOX hypervisor introduced to guard the Android kernel's integrity at runtime. The...
Project Zero's Gal Beniamini described a flaw in Android's ashmem shared memory in which the mmap length is computed from bitmap metadata while the munmap length comes from the ASHMEM_GET_SIZE ioctl, letting an attacker unmap an arbitrarily large range of...
Google Project Zero's Mateusz Jurczyk spent a year fuzzing the Windows kernel font engine, using a 19,507-file corpus (14,848 TrueType and 4,659 OpenType fonts, about 2.4G) drawn from earlier FreeType2 work and mutating each SFNT table individually rather...
Google Project Zero's Mateusz Jurczyk reports that a year of at-scale fuzzing of TrueType and OpenType font handling in the Windows kernel produced 16 vulnerabilities, reported to Microsoft in three iterations beginning 21 May 2015 and fixed between July...
On June 1st, 2016, Jann Horn of Google Project Zero reported an arbitrary recursion bug in the Linux kernel that a local user can trigger on Ubuntu systems installed with home directory encryption support. The bug chains ecryptfs mounts backed by...
Ian Beer of Google Project Zero described a race condition in the OS X and iOS kernel's setuid root binary loading: the kernel swaps the new virtual memory map pointer into the old task object before invalidating the old task port, leaving a window to...
Chrome Security's Oliver Chang documented two use-after-free race conditions in Chrome's MIDI implementation, found during a Chrome IPC bug bash with Project Zero, that could be triggered directly from the web without compromising the sandboxed renderer....
Project Zero's James Forshaw described a flaw in the TrueCrypt Windows driver, in the TC_IOCTL_MOUNT_VOLUME and TC_IOCTL_DISMOUNT_VOLUME handlers in Driver\Ntdriver.c, that lets an application running as a normal user or inside a low-integrity sandbox...
Google Project Zero's Ian Beer detailed a set of bugs in Apple's Distributed Objects IPC mechanism, including CVE-2015-5784 in the setuid-root Install.framework 'runner' executable, which creates 'Library/Receipts' directories as root on request. Because...
Microsoft added three symbolic link mitigations to Windows 10 and back ported them via MS15-090 as far back as Windows Vista, changing who can create registry key symbolic links, object manager symbolic links, and NTFS mount points. The checks rest on a...
Project Zero worked with Adobe to land exploit mitigations in Flash v18.0.0.209, including heap partitioning that moves Vector.<uint> buffer objects out of the general Flash heap and into the standard system heap, plus stronger randomization of the Flash...