googleprojectzero.blogspot.com
Covers: Vulnerabilities & PatchingZero-Days & ExploitsSupply Chain & AppSecGovernance, Risk & ComplianceEndpoint & Network SecurityCloud SecurityDetection & Response
Project Zero's Mateusz Jurczyk, in Part 4 of a series on exploiting a Samsung Qmage image codec, set up a PC-based MMS test rig using two SIM cards, a licensed NowSMS server, a Galaxy A50 as modem and a Galaxy Note 10+ as receiver. He then used the MMS...
Google Project Zero researcher Brandon Azad found a memory corruption flaw in pmap_remove_options_internal(), a PPL routine in Apple's XNU kernel, where a virtual address range crossing an L3 translation table boundary causes out-of-bounds TTE removal and...
Google Project Zero's Brandon Azad described a new iOS kernel exploitation technique that turns a controlled one-byte heap overflow into a read/write primitive for arbitrary physical addresses, sidestepping KASLR, PAC, and zone_require. The technique...
Google Project Zero began publishing root cause analyses for 0-days exploited in the wild, releasing 8 RCAs covering 20 tracked 2019 0-days, including iOS CVE-2019-7286 and CVE-2019-7287, Firefox CVE-2019-1107, Internet Explorer CVE-2019-1367 and...
Project Zero's year-in-review found 20 zero-days detected and disclosed as exploited in the wild in 2019, with 11 of them in Microsoft products and 10 of those 11 targeting legacy software such as Windows 7 or Internet Explorer. The team concluded that the...
Project Zero's Mateusz Jurczyk, having fuzzed Samsung's Qmage image codec and reported crashes to Samsung on 28 January 2020, triaged the 174 heap "write" crashes down to 23 unique overwritten allocation sites and then 17 after filtering out QMv1 cases. He...
Project Zero's Mateusz Jurczyk built a fuzzing harness called SkCodecFuzzer to target Samsung's Qmage image codec, which is reachable via MMS through the default Samsung Messages app and is natively supported on all modern Samsung phones. He ran the...
Project Zero researcher Mateusz Jurczyk reported a large volume of crashes in January 2020 in Qmage, a proprietary Samsung image codec written in C/C++ and built into the Skia graphics library, present on all Samsung phones since Android 4.4.4 and enabled...
On May 23, 2020, the unc0ver jailbreak shipped for iOS 13.5 using a zero-day and heavy obfuscation; Project Zero's Brandon Azad identified the bug by 7 PM that day and sent Apple a POC and analysis by 1 AM. Killing the app mid-jailbreak produced a kernel...
Project Zero's James Forshaw documented a Firefox sandbox escape (CVE-2020-12388) in which one Level 5 content process could open another for full access, because the sandbox's Default DACL granted full access to the Current User, SYSTEM, and RESTRICTED...
Project Zero's James Forshaw found that a one-line change in Windows 10 1903's SepFilterToken kernel function, which copied the Parent Token ID directly from the old token instead of assigning a new one, broke the sibling-token check that Chromium's...
Project Zero's Maddie Stone set out to root-cause CVE-2019-1458, a Win32k escalation-of-privilege flaw reported exploited in the wild and patched in December 2019, by binary patch-diffing Windows 7 win32k.sys because she could not obtain the exploit...
Project Zero's Mateusz Jurczyk found that macOS Adobe Reader installers from versions 7.x through DC shipped debug symbols, with 8.x and 9.x releases carrying the most data, including private stabs-format symbols for the 3D module (7.x) and the CoolType...
Project Zero's Samuel Groß published the third and final post in a series on a remote, interactionless iPhone exploit over iMessage, showing how to turn the vulnerability into native code execution on devices without pointer authentication, namely the...
Project Zero's Samuel Groß described a method to defeat ASLR remotely on iOS without any additional information disclosure vulnerabilities, using heap spraying over iMessage and a crash oracle built on delivery receipts. The released code infers the dyld...
Project Zero's Samuel Groß detailed CVE-2019-8641, an iMessage vulnerability on iOS 12.4 that let an attacker holding only a target's Apple ID gain remote control of the device within minutes, with no user interaction and no on-screen indicator. Reported...
Project Zero's James Forshaw released tooling in his Sandbox Analysis Tools repository that lets .NET and PowerShell code call Local Windows RPC servers directly, including a client generator that parses RPC server information and emits C# source. He...
Project Zero's Ned Williamson published a walkthrough of CVE-2019-8605, a use-after-free in the XNU kernel present as early as 2013 that he reported to Apple in March 2019 and that was patched in iOS 12.3 in May 2019. The bug regressed in iOS 12.4 and was...
Project Zero disclosed CVE-2019-2215 on October 3, 2019, a use-after-free in the Android kernel's Binder driver that allows local privilege escalation and full device compromise, and reported it under a 7-day deadline based on credible evidence an exploit...
Project Zero researcher Brandon Azad found on June 16th that the A11 SoC in the iPhone 8 and iPhone X has CoreSight External Debug registers enabled, which combined with a reversed proprietary register called DBGWRAP allows debugging the CPU at any point,...
Project Zero researcher Mateusz Jurczyk analyzed Adobe Reader executables and libraries across versions dating back to 1997 and found that Unix builds of acroread, AGM, CoolType, BIB, JP2K and rt3d shipped with embedded debug symbols at various points,...
Project Zero's James Forshaw documented techniques for spoofing the client PID that Windows named pipe servers read through the GetNamedPipeClientProcessId API, a feature introduced in Vista and used by some third-party software, including Check Point...
Google's Threat Analysis Group found a small collection of hacked websites running indiscriminate watering hole attacks that used iPhone 0-day to install a monitoring implant on visitors, with no target discrimination and an estimated thousands of visitors...
Google Project Zero documented an in-the-wild iOS exploit chain targeting iOS 10.0.1 through 10.1.1 on iPhone 5s through 7, likely active since September 2016. The chain exploits a heap overflow in AGXAllocationList2::initWithSharedResourceList in the...
Project Zero's Ian Beer documented an in-the-wild iOS exploit chain targeting iOS 10.3 through 10.3.3 on devices from the iPhone 5s through the iPhone 7, built on a kernel bug tracked as CVE-2017-13861. The flaw was in IOSurfaceRootUserClient external...
Project Zero's Samuel Groß analyzed seven WebKit exploits used to gain an initial foothold on iPhones, each achieving shellcode execution inside the sandboxed WebContent renderer process and each tied to a specific iOS version range from 10.0 through...
Project Zero's Ian Beer documented an in-the-wild iOS exploit chain, disclosed 2019-Aug-29, that supported iOS 12 through 12.1 and combined a cfprefsd sandbox escape with a kernel bug in an IOKit driver whose external method performs an unbounded memmove...
Project Zero's Ian Beer documented an in-the-wild iOS exploit chain, dubbed In-the-wild iOS Exploit Chain 5, that targeted iPhone 5s through X running iOS 11.4.1 through 12.1.2, exploiting a use-after-free in the task_swap_mach_voucher kernel MIG method....
Project Zero's Ian Beer published a teardown of an iOS implant that attackers dropped in /tmp via posix_spawn after gaining root through exploit chains, running with no visual indicator on the device. The implant polls a command and control server every 60...
Google Project Zero researcher Felix Wilhelm found CVE-2022-34169, an integer truncation bug in a custom JIT compiler inside Java's standard library that processes untrusted XSLT programs during XML signature verification, leading to arbitrary code...