googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Project Zero's Tavis Ormandy found that unprivileged Windows applications could send messages in the 0xC000-0xFFFF range to privileged windows, contradicting the whitelist in win32k!IsMessageAlwaysAllowedAcrossIL. Tracing the behavior with a debugger led...
Google's Project Zero reported 376 issues to vendors under its standard 90-day deadline between January 2019 and December 2021, of which 351 (93.4%) were fixed, 14 (3.7%) were marked WontFix, and 11 (2.9%) remained unfixed. Across 346 fixed bugs, 294 (84%)...
Google Project Zero analyzed FORCEDENTRY, an NSO iMessage zero-click exploit used to target a Saudi activist, which Citizen Lab captured from an iPhone and which Apple fixed on September 13, 2021 as CVE-2021-30860 in iOS 14.8. The exploit abused iMessage's...
Google Project Zero's James Forshaw detailed a technique for relaying DCOM authentication locally, building on his 2015 issue 325 (fixed as CVE-2015-2370) and the later RottenPotato and RemotePotato exploits, the latter unpatched as of October 2021. The...
Google Project Zero's Ivan Fratric combined the Fuzzilli JavaScript engine fuzzer with the TinyInst dynamic instrumentation library, and added grammar-based mutation support to his black-box binary fuzzer Jackalope, to fuzz closed-source JavaScript...
Google Project Zero's James Forshaw found a configuration issue in the Windows Firewall that let an AppContainer process bypass network restrictions and reach services on localhost and intranet resources in an Enterprise. Microsoft marked the issue...
Google Project Zero's Ned Williams built sockfuzzer, a fuzzer that ports XNU's networking stack into userland as a library and calls syscalls like connectx directly alongside injected packets via ip_input and ip6_input. The project reproduced peers' recent...
Google Project Zero's James Forshaw researched Windows Server Containers and found four privilege escalations that Microsoft fixed in March 2021. The work followed Palo Alto Networks researcher Daniel Prizmant's discovery that global symbolic links could...
In October 2020, Google Project Zero discovered seven 0-day exploits being actively used in-the-wild, delivered via watering hole attacks on a couple dozen websites that redirected to two exploit servers hosting chains for Android, Windows, and iOS. The...
Google Project Zero's Samuel Groß published a one-week reverse engineering analysis of iOS 14's iMessage hardening, prompted by Citizen Lab's December 20 report that the suspected NSO Group iMessage zero-click exploit does not work against iOS 14 and...
Google Project Zero's James Forshaw describes a Windows exploitation trick that traps access to virtual memory, gets feedback when it occurs, and delays access indefinitely, succeeding mostly on the latest Windows 10 versions. The technique targets...
Project Zero's Natalie Silvanovich found that a logic bug in FaceTime's calling state machine, disclosed January 29, 2019, let an attacker force a call to connect and listen to the target's surroundings without the target's interaction. She then tested...
Google Project Zero's James Forshaw detailed four Windows vulnerabilities Microsoft fixed in December in the Cloud Filter and Windows Overlay Filter (WOF) drivers: CVE-2020-17103, CVE-2020-17134, CVE-2020-17136, and CVE-2020-17139, comprising three local...
Google Project Zero's fourth in-the-wild report describes a 2020 high-tier attacker pairing a Chrome 0-day with Android privilege-elevation exploits built almost entirely from public code and n-day bugs patched 2 to 5 years earlier, including...
Project Zero's third post in a six-part series details Chrome exploits used in a watering hole attack discovered in early 2020, all targeting JIT compiler bugs in V8, Chrome's JavaScript engine. Three of the four issues were independently discovered by...
Google Project Zero launched a six-part series on vulnerabilities it found being exploited in the wild, starting with a Q1 2020 watering hole attack by a highly sophisticated actor that ran two exploit servers, one targeting Windows users and one targeting...
Google Project Zero researcher Brandon Azad, coming from a background in iOS exploitation, wrote a kernel exploit for the Samsung Galaxy S10 by chaining two bugs in Samsung's Neural Processing Unit driver that Ben Hawkes had reported: a linear heap...
A surveillance vendor named Wintego developed an exploit for Linux socket syscall CVE-2021-0920 and used it in the wild from at least November 2020 until the issue was fixed in November 2021, combining it with Chrome and Samsung browser exploits to...
Google Project Zero analyzed a fake "My Vodafone" carrier app that was sideloaded onto iPhones using an enterprise certificate purchased through Apple's $299 Enterprise developer program, bypassing App Store review. The app bundled six privilege escalation...
Google Project Zero's Ian Beer published an analysis of CVE-2021-1782, an XNU vouchers subsystem vulnerability fixed in iOS 14.4 on January 26th 2021, which Apple's release notes later updated on May 28th 2021 to say may have been actively exploited in the...
Google Project Zero's Ian Beer analyzed CVE-2021-30737, a memory corruption bug in the ASN.1 decoder that Apple fixed in iOS 14.6 by removing vulnerable code, after @xerub tweeted about it on May 25, 2021. The flaw sits in sec_asn1d_parse_bit_string, part...
Google Project Zero detailed the sandbox escape stage of FORCEDENTRY, the zero-click iMessage exploit Citizen Lab attributed to NSO, which used a .gif attachment that was really a PDF to trigger a heap buffer overflow in the ImageIO JBIG2 decoder. The...
Google Project Zero researchers found a race condition in the Linux kernel's UNIX domain socket garbage collection code, where the GC assumes exclusive access to a file by comparing its refcount against inflight socket buffer references, but an RCU...
Google Project Zero researcher Ian Beer spent roughly six months of 2020 building a wormable radio-proximity exploit that gave him complete control over any iPhone in his vicinity, using a single memory corruption vulnerability - a buffer overflow in C++...
Project Zero researcher Brandon Azad describes missing an out-of-bounds bug in the iOS H11ANEIn driver's H11ANEInDirectPathClient user client, which he had mistakenly explained as Apple intentionally sharing external method tables between two user client...
Google Project Zero's Felix Wilhelm found two vulnerabilities, CVE-2020-16250 and CVE-2020-16251, in HashiCorp Vault's aws and gcp auth methods that can lead to authentication bypass; HashiCorp fixed them in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1...
Google Project Zero's Ben Hawkes found that Qualcomm's patch for CVE-2019-10567 was incomplete, and worked with Qualcomm to fix the root cause as CVE-2020-11179, which Qualcomm made available to OEMs in August 2020 and planned to list in its November 2020...
Project Zero's Samuel Groß detailed CVE-2020-9802, a JavaScriptCore JIT compiler bug in which DFGClobberize failed to account for the ArithMode of ArithNegate, letting common-subexpression elimination substitute a checked negation with an unchecked one....
Project Zero's Samuel Groß detailed how a Safari JIT bug, CVE-2020-9802, was turned into a stable arbitrary memory read/write primitive by faking a JSArray object and reading a legitimate JSCell header to bypass WebKit's StructureID randomization. The...
Google Project Zero's Samuel Groß published the third part of a series on a Safari renderer exploit, detailing how iOS 13's JIT hardenings - APRR and PAC - can be bypassed; the exploited vulnerability CVE-2020-9802 was fixed in iOS 13.5, while two...