googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Project Zero's Chris Evans described a technique for exploiting Adobe Flash bug 324 by associating a shader parameter from one program with a different program, producing an intra-chunk corruption rather than the inter-chunk corruption used in the series'...
Project Zero's Chris Evans published a four-part 2015 series ranking memory corruption bug classes by how reliably they can be exploited, defining a "100% reliable" exploit as one guaranteed to succeed against a specific version and environment through...
Project Zero's James Forshaw documented CVE-2014-3196, a Chrome for Windows bug fixed in M38 where unnamed shared memory sections carry no security descriptor, letting a compromised renderer call DuplicateHandle to regain write access to a section shared...
Ian Beer's Project Zero write-up describes chaining a Safari JavaScript integer truncation bug into the renderer process with two OS X kernel bugs to launch Calculator.app as root from inside the Safari sandbox. The kernel exploit abused an OS X GPU driver...
Project Zero's James Forshaw disclosed three Internet Explorer Enhanced Protected Mode sandbox escapes in August 2014, all fixed in Microsoft's MS14-065 update, with CVE-2014-6350 stemming from weak permissions on the IE broker process that granted the...
Project Zero guest researcher Stephen Röttger found CVE-2014-9295, a global buffer overflow in ntpd's control packet handling that he exploited on OS X Mavericks, triggered by an attacker on the local network sending an IPv6 packet with a spoofed ::1...
Project Zero's James Forshaw documented CVE-2015-0002, a flaw in the Windows 8.1 ahcache.sys driver where the AhcVerifyAdminContext function fails to verify that an impersonation token is at the privileged SecurityImpersonation level rather than the...
Project Zero's Natalie Silvanovich reported CVE-2015-0336, a type confusion bug in Flash's ActionScript 2 NetConnection class caused by a faulty type check that lets a native function object pass as a NetConnection. Adobe patched it in March 2015, and less...
Project Zero's James Forshaw described an unfixed Windows 8.1 bug in which the condrv.sys console driver calls ZwCreateUserProcess with the PROCESS_BREAKAWAY_JOB flag, letting a process escape a restrictive job object such as the one Chrome uses to limit...
Project Zero's Tavis Ormandy published a working remote root exploit for an ESET vulnerability in June 2015, showing that arithmetic operations on ESP bypass the bounds check on the emulator's 40-byte shadow stack, letting attackers build a...
Project Zero's Chris Evans reported four Adobe Flash Player memory-leakage vulnerabilities (CVE-2014-0542 through CVE-2014-0545) that Adobe fixed in its August 2014 security update, roughly 30 days after report. All four stem from image decoding that...
Project Zero's Oliver Chang found 16 vulnerabilities in NVIDIA's Windows kernel-mode graphics drivers during a 20% project, 13 of them in the DxgkDdiEscape interface, which NVIDIA exposes with roughly 400 escape codes callable directly from user mode. The...
Project Zero's Natalie Silvanovich fuzzed FaceTime's encrypted audio and video streams by hooking CCCryptorUpdate and sendmsg in the avconferenced daemon, then built a replay tool that corrected SSRC, payload type, marker, and sequence numbers to reproduce...
Project Zero's Natalie Silvanovich documented how Samsung's vulnerability reporting process for CVE-2018-10751, a remote memory corruption flaw in OMACP on the Samsung S7 Edge triggerable by a single SMS with no user interaction, required creating an...
Google Project Zero's Mark Brand documented a full Chrome exploit chain that combined a renderer bug, CVE-2019-5782 in the v8 typer, with a use-after-free in the FileWriter interface of the FileSystem API to escape the Chrome sandbox on 64-bit Windows...
Project Zero's Mark Brand disclosed CVE-2016-3861, a bug in libutils' UTF16-to-UTF8 conversion where utf16_to_utf8_length and utf16_to_utf8 disagree on output size, allowing a heap overflow of a controlled size in multiples of 4 bytes. The flaw is...
Google Project Zero researcher Mateusz Jurczyk detailed a memory disclosure vulnerability in the PostScript font engines shared by the Windows kernel ATMFD.DLL (CVE-2015-0089), Adobe Reader (CVE-2015-3049), DirectWrite and Windows Presentation Foundation...
Google Project Zero researcher Mateusz Jurczyk disclosed a set of font-engine vulnerabilities found in a shared PostScript Charstring interpreter, including CVE-2015-0093 (Adobe's CVE-2015-3052), a flaw in the BLEND Charstring instruction present in Adobe...
Google Project Zero's Ivan Fratric published a proof-of-concept showing that a timing attack on Internet Explorer's MemoryProtector mitigation can reveal the offset used by High Entropy Bottom-Up Randomization, which introduces 1TB of variance in heap...
Google Project Zero's James Forshaw released an open-source toolset, under an Apache v2 license, for analyzing the attack surface of Windows user-mode sandboxes by using the kernel's AccessCheck function to determine what resources a sandboxed process...
Project Zero's James Forshaw described how NTFS hard links can serve as a privilege-escalation primitive, because the kernel's NtSetInformationFile requested no access rights on the target file for the FileLinkInformation class, letting a sandboxed process...
Project Zero's James Forshaw described a Windows elevation-of-privilege flaw in NtCreateLowBoxToken, the Windows 8 system call behind AppContainer and IE11 Enhanced Protected Mode tokens, which Microsoft fixed in bulletin MS15-111. The kernel captured...
Project Zero's James Forshaw published a 2016 guide showing that Win32 file paths pass through RtlDosPathNameToRelativeNtPathName_U, which sorts them into 7 path types and canonicalizes them by converting forward slashes, collapsing separators, resolving...
Project Zero's James Forshaw found a bug in Windows' Secondary Logon service, fixed in March 2016 as MS16-032, that let a normal process leak a full-access thread handle from the privileged service. The service's handle-duplication code checked that bit 29...
Google Project Zero's James Forshaw developed a Win32k system call lockdown mitigation for Chrome on Windows, shipping by default in Chrome M54 on Windows 10 after roughly two years of architectural work including replacing GDI-based font code with...
Project Zero's James Forshaw described a vulnerability class in .NET's COM interoperability layers that makes .NET DCOM across privilege boundaries inherently insecure, exploiting the IManagedObject interface's GetSerializedBuffer method to trigger...
James Forshaw of Google Project Zero described a technique that turns an arbitrary directory creation bug into an arbitrary file read on Windows, using a vulnerable workshop driver that calls ZwCreateFile with FILE_DIRECTORY_FILE and FILE_OPEN_IF without...
Project Zero published a full exploit chain for two CUPS bugs: CVE-2015-1158, a reference-count over-decrement in cupsd string handling that lets an attacker free an arbitrary global string, and CVE-2015-1159, a cross-site scripting bug in the CUPS...
Google Project Zero disclosed a vulnerability, dubbed 666, in FireEye's NX, FX, AX and EX series appliances that could be triggered through the passive monitoring interface by sending a JAR file across the network, which FireEye's JODE decompiler would...
Google Project Zero's Tavis Ormandy published details of multiple critical vulnerabilities in Symantec and Norton antivirus products, including wormable remote code execution flaws that need no user interaction, affect default configurations, and on...