exploit the possibilities
Showing 1 - 25 of 119 RSS Feed

Files from Jann Horn

Email addressjannh at google.com
First Active2013-03-14
Last Active2019-11-05
XNU Missing Locking Race Condition
Posted Nov 5, 2019
Authored by Jann Horn, Google Security Research

XNU has an issue where missing locking in checkdirs_callback() enables a race condition with fchdir_common().

tags | exploit
MD5 | 85e06607829ab208006bfe5a5ef59847
Linux Polkit pkexec Helper PTRACE_TRACEME Local Root
Posted Oct 23, 2019
Authored by Brendan Coles, Jann Horn, timwr | Site metasploit.com

This Metasploit module exploits an issue in ptrace_link in kernel/ptrace.c before Linux kernel 5.1.17. This issue can be exploited from a Linux desktop terminal, but not over an SSH session, as it requires execution from within the context of a user with an active Polkit agent. In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME.

tags | exploit, kernel, local, root
systems | linux
advisories | CVE-2019-13272
MD5 | a67b52657090e25d42aa370f66e7ca88
XNU Data Race Remote Double-Free
Posted Oct 7, 2019
Authored by Jann Horn, Google Security Research

XNU suffers from a remote double-free vulnerability due to a data race in IPComp input path.

tags | exploit, remote
advisories | CVE-2019-8717
MD5 | f107571d24ce915ad24992a19c351dc1
Linux show_numa_stats() Use-After-Free
Posted Aug 8, 2019
Authored by Jann Horn, Google Security Research

Linux suffers from use-after-free read vulnerabilities in show_numa_stats().

tags | exploit, vulnerability
systems | linux
MD5 | 19f13c14c14a87e2b867f6b005de2eae
Linux PTRACE_TRACEME Broken Permission / Object Lifetime Handling
Posted Jul 16, 2019
Authored by Jann Horn, Google Security Research

Linux suffers from broken permission and object lifetime handling for PTRACE_TRACEME.

tags | exploit
systems | linux
advisories | CVE-2019-13272
MD5 | 91c78e7e5a824d9c7ed235f47eecb190
Google ChromeOS SafeSetID LSM Transitive Trust
Posted Jul 3, 2019
Authored by Jann Horn, Google Security Research

Google ChromeOS SafeSetID LSM suffers from privilege escalation vulnerabilities.

tags | advisory, vulnerability
MD5 | 1eb159ed1602375544f5e4c09949e034
Linux Race Condition Use-After-Free
Posted Jun 20, 2019
Authored by Jann Horn, Google Security Research

Linux suffers from a use-after-free via a race condition between modify_ldt() and #BR exception.

tags | exploit
systems | linux
MD5 | bde5e2b4c6bf6932f0057efcb1d79bac
Qualcomm Android Kernel Use-After-Free
Posted May 29, 2019
Authored by Jann Horn, Google Security Research

The Qualcomm Android kernel suffers from a use-after-free vulnerability via an incorrect set_page_dirty() in KGSL.

tags | exploit, kernel
advisories | CVE-2019-10529
MD5 | 934ee0432bced903b9c092168a681f86
Linux Missing Lockdown
Posted Apr 29, 2019
Authored by Jann Horn, Google Security Research

Linux suffers from a missing locking between ELF coredump code and userfaultfd VMA modification.

tags | exploit
systems | linux
advisories | CVE-2019-11599
MD5 | 6e83b659aeebd1f611e769f9fff5b64b
systemd DynamicUser SetUID Binary Creation
Posted Apr 25, 2019
Authored by Jann Horn, Google Security Research

This bug report describes a bug in systemd that allows a service with DynamicUser in collaboration with another service or user to create a setuid binary that can be used to access its UID beyond the lifetime of the service. This bug probably has relatively low severity, given that there are not many services yet that use DynamicUser, and the requirement of collaboration with another process limits the circumstances in which it would be useful to an attacker further; but in a system that makes heavy use of DynamicUser, it would probably have impact.

tags | exploit
advisories | CVE-2019-3844
MD5 | cb138590286ec36c3796f89c3e18cff6
Linux Siemens R3964 Line Discipline Missing Lock
Posted Apr 23, 2019
Authored by Jann Horn, Google Security Research

The Siemens R3964 line discipline code in drivers/tty/n_r3964.c has a few races around its ioctl handler; for example, the handler for R3964_ENABLE_SIGNALS just allocates and deletes elements in a linked list with zero locking. This code is reachable by an unprivileged user if the line discipline is enabled in the kernel config; Ubuntu 18.04, for example, ships this line discipline as a module.

tags | exploit, kernel
systems | linux, ubuntu
MD5 | 1820caa252c106e5cc11b80e59c7e65c
Linux Overflow Via FUSE
Posted Apr 23, 2019
Authored by Jann Horn, Google Security Research

Linux suffers from a page->_refcount overflow via FUSE with ~140GiB RAM usage.

tags | exploit, overflow
systems | linux
MD5 | 47cf01f1d9bc811d111aac20bfd03627
systemd Seat Verification Active Session Spoofing
Posted Apr 23, 2019
Authored by Jann Horn, Google Security Research

systemd suffers from a lack of seat verification in the PAM module and in turn permits the spoofing of an active session to polkit.

tags | exploit, spoof
advisories | CVE-2019-3842
MD5 | da7d4cd8a891ee21f0b9d4c6fec61329
libseccomp Incorrect Compilation Of Arithmetic Comparisons
Posted Mar 18, 2019
Authored by Jann Horn, Google Security Research

libseccomp suffers from an issue where there are incorrect compilations of arithmetic comparisons.

tags | exploit
MD5 | 527bc24d7a88f082d48938d2aa6fb5c0
Linux Virtual Address 0 Mappable Via Privilege write()
Posted Mar 6, 2019
Authored by Jann Horn, Google Security Research

It was discovered that virtual address 0 is mappable via privileged write() to /proc/*/mem on Linux.

tags | exploit
systems | linux
advisories | CVE-2019-9213
MD5 | e66eec069282b7aa4ec9437eb8308ef8
Android getpidcon() ACL Bypass
Posted Mar 6, 2019
Authored by Jann Horn, Google Security Research

getpidcon() usage in hardware binder servicemanager on Android permits ACL bypass.

tags | exploit
advisories | CVE-2019-2023
MD5 | 4a5995063ac40d52861f758041827b02
Android Binder Use-After-Free
Posted Mar 6, 2019
Authored by Jann Horn, Google Security Research

Android suffer from a binder use-after-free via a racy initialization of ->allow_user_free.

tags | exploit
advisories | CVE-2019-2025
MD5 | 05c41c04dbf0a020804a8db2fdf4eca1
XNU Copy-On-Write Behavior Bypass
Posted Mar 1, 2019
Authored by Jann Horn, Google Security Research

XNU suffers from a copy-on-write behavior bypass via mount of user-owned filesystem image.

tags | exploit
MD5 | babb0ad99959bd04e0f28e89ee861d68
Linux SNMP NAT Module Out-Of-Bounds Read/Write
Posted Feb 25, 2019
Authored by Jann Horn, Google Security Research

Linux suffers from out-of-bounds read and write vulnerabilities in the SNMP NAT module.

tags | exploit, vulnerability
systems | linux
MD5 | c08eaed82dad3bd5f77b4f40d1deedbb
Android seccomp Filter Ptrace Hole
Posted Feb 19, 2019
Authored by Jann Horn, Google Security Research

On Android, a ptrace hold makes the seccomp filter useless on devices with a kernel with a version lower than 4.8.

tags | exploit, kernel
MD5 | ec62513ec742cfdc38e9e8d04849f77c
Linux kvm_ioctl_create_device() Reference Flow Failure
Posted Feb 15, 2019
Authored by Jann Horn, Google Security Research

Linux kvm_ioctl_create_device() installs fd before taking reference.

tags | exploit
systems | linux
advisories | CVE-2019-6974
MD5 | 2c781194b8d221ac15f3178b357e1b58
Android Binder VMA Use-After-Free
Posted Feb 12, 2019
Authored by Jann Horn, Google Security Research

Android binder suffers from a use-after-free vulnerability in VMA via a race between reclaim and munmap.

tags | exploit
advisories | CVE-2019-1999
MD5 | b595de41d1f8f84b4916fab4d16567de
Android Binder fdget() Optimization Use-After-Free
Posted Feb 12, 2019
Authored by Jann Horn, Google Security Research

Android binder suffers from a use-after-free vulnerability via fdget() optimization.

tags | exploit
advisories | CVE-2019-2000
MD5 | bc3a95911082f54f5d3a2b398792bb8b
Linux Insufficient eBPF Spectre V1 Mitigation
Posted Feb 2, 2019
Authored by Jann Horn, Google Security Research

It has been discovered that the Linux eBPF Spectre v1 mitigation is insufficient.

tags | exploit
systems | linux
advisories | CVE-2019-7308
MD5 | 60ad2b402e4b79e4579ab76baec63e80
XNU copy-on-write Behavior Bypass
Posted Jan 31, 2019
Authored by Jann Horn, Google Security Research

XNU suffers from a copy-on-write behavior bypass via partial-page truncation of file.

tags | exploit
advisories | CVE-2019-6208
MD5 | 777063e937de55773212655e72ee59fb
Page 1 of 5
Back12345Next

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    0 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close