exploit the possibilities
Showing 1 - 25 of 1,523 RSS Feed

Files from Google Security Research

First Active2000-02-18
Last Active2020-09-14
Linux expand_downwards() / munmap() Race Condition
Posted Sep 14, 2020
Authored by Jann Horn, Google Security Research

A race condition exists with munmap() downgrades in Linux kernel versions since 4.20.

tags | exploit, kernel
systems | linux
MD5 | af84b28deac71be6c5fa63ed3e242c89
Microsoft Windows StorageFolder Marshaled Object Access Check Bypass / Privilege Escalation
Posted Sep 8, 2020
Authored by James Forshaw, Google Security Research

The StorageFolder class when used out of process can bypass security checks to read and write files not allowed to an AppContainer.

tags | exploit
advisories | CVE-2020-0886
MD5 | fcac5139eefb819b4a7b0e211caa1f0d
Qualcomm Adreno GPU Ringbuffer Corruption / Protected Mode Bypass
Posted Sep 8, 2020
Authored by Google Security Research, hawkes

The Qualcomm Adreno GPU shares a global mapping called a "scratch" buffer with the Adreno KGSL kernel driver. The contents of the scratch buffer can be overwritten by untrusted GPU commands. This results in a logic error in the Adreno driver's ringbuffer allocation code, which can be used to corrupt ringbuffer data. A race condition exists between the ringbuffer corruption and a GPU context switch, and this results in a bypass of the GPU protected mode setting. This ultimately means that an attacker can read and write arbitrary physical addresses from userland by running GPU commands while protected mode disabled, which results in arbitrary kernel code execution.

tags | exploit, arbitrary, kernel, code execution
advisories | CVE-2020-11179
MD5 | 1b8910b13d2d3595dcd217d98080e491
Microsoft Windows CloudExperienceHostBroker Privilege Escalation
Posted Sep 8, 2020
Authored by James Forshaw, Google Security Research

The CloundExperienceHostBroker hosts unsafe COM objects accessible to a normal user leading to elevation of privilege.

tags | exploit
advisories | CVE-2015-2528, CVE-2020-1471
MD5 | c38651bc173d658ea5caddd8450163b6
Apache2 mod_proxy_uwsgi Incorrect Request Handling
Posted Aug 31, 2020
Authored by Google Security Research, Felix Wilhelm

Apache2 suffers from an incorrect handling of large requests issue in mod_proxy_uwsgi.

tags | advisory
advisories | CVE-2020-11984
MD5 | 794813ee73c7fb742550accd8b61f2e2
Chrome NewFixedArray Missing Array Size Check
Posted Aug 25, 2020
Authored by Google Security Research, Glazvunov

Chrome suffers from a missing array size check in NewFixedArray.

tags | exploit
MD5 | 3f2e8b27a8a3776f81ab7b46459f8a8e
Linux CoW Incorrect Access Grant
Posted Aug 25, 2020
Authored by Jann Horn, Google Security Research

A Linux copy-on-write issue can wrongly grant write access.

tags | exploit
systems | linux
MD5 | cb589228c2f3845aa384c84f4717d60e
Microsoft Windows CmpDoReadTxRBigLogRecord Memory Corruption Privilege Escalation
Posted Aug 21, 2020
Authored by James Forshaw, Google Security Research

The handling of KTM logs when initializing a Registry Hive contains no bounds checks which results in privilege escalation.

tags | exploit, registry
advisories | CVE-2020-1378
MD5 | 47cc29fc3f9a4152d374689e8d8dbe44
Microsoft Windows CmpDoReDoCreateKey Arbitrary Registry Key Creation Privilege Escalation
Posted Aug 21, 2020
Authored by James Forshaw, Google Security Research

The handling of KTM logs does not limit Registry Key operations to the loading hive leading to elevation of privilege.

tags | exploit, registry
advisories | CVE-2020-1377
MD5 | cde9e4062cc05fc18d17cf5eabad623b
PAC Bypass Due To Unprotected Function Pointer Imports
Posted Aug 19, 2020
Authored by saelo, Google Security Research

PAC aims to prevent an attacker with the ability to read and write memory from executing arbitrary code. It does that by cryptographically signing and validating code pointers (as well as some data pointers) at runtime. However, it seems that imports of function pointers from shared libraries in userspace are not properly protected by PAC, allowing an attacker to sign arbitrary pointers and thus bypass PAC.

tags | advisory, arbitrary
advisories | CVE-2020-9870
MD5 | 1d4d2c1d8f30ccfd1c36adfae489b2a3
Samsung Android Skia Qmage Image Codec Heap Buffer Overflow
Posted Aug 17, 2020
Authored by Google Security Research, mjurczyk

Samsung Android suffers from a heap buffer overflow vulnerability and other issues in the Skia Qmage image codec.

tags | exploit, overflow
MD5 | 95361e7360e3cb6d869c21f91cad170e
WebKit On iOS PAC / JIT Hardening Bypass
Posted Aug 14, 2020
Authored by saelo, Google Security Research

A PAC and JIT hardening bypass exists in WebKit on iOS.

tags | advisory
systems | ios
advisories | CVE-2020-9910
MD5 | a3ac179138a9ac48c78209344b6266c3
Android App Zygotes Improper Guarding
Posted Aug 14, 2020
Authored by Jann Horn, Google Security Research

On Android, app zygotes do not properly guard against UID reuse attacks, leak AID_READPROC, and expose mlstrustedsubject.

tags | exploit
advisories | CVE-2020-0258
MD5 | eebe6e6bf1383e7dfd3785cc4de920bc
Microsoft Windows AppContainer Enterprise Authentication Capability Bypass
Posted Aug 13, 2020
Authored by James Forshaw, Google Security Research

On Microsoft Windows 10 1909, LSASS does not correctly enforce the Enterprise Authentication Capability which allows any AppContainer to perform network authentication with the user's credentials.

tags | exploit
systems | windows
advisories | CVE-2020-1509
MD5 | a9c5a593a7fd8beb544d51baa38c1730
c-ares 1.16.0 Use-After-Free
Posted Aug 4, 2020
Authored by Jann Horn, Google Security Research

c-ares version 1.16.0 has an issue where ares_destroy() with pending ares_getaddrinfo() leads to a use-after-free condition.

tags | advisory
MD5 | 1464ba2a11ec60f5b9714b8e26693d59
iOS Page Protection Layer (PPL) Bypass
Posted Jul 31, 2020
Authored by Google Security Research, bazad

iOS suffers from a Page Protection Layer (PPL) bypass due to incorrect argument verification in pmap_protect_options_internal() and pmap_remove_options_internal().

tags | exploit
systems | ios
advisories | CVE-2020-9909
MD5 | 880d5a7841d44d213ff1f1ca340b8776
WebRTC usrsctp Incorrect Call
Posted Jul 31, 2020
Authored by Google Security Research

When usrsctp is used with a custom transport, an address must be provided to usrsctp_conninput be used as the source and destination address of the incoming packet. WebRTC uses the address of the SctpTransport instance for this value. Unfortunately, this value is often transmitted to the peer, for example to validate signing of the cookie. This could allow an attacker access to the location in memory of the SctpTransport of a peer, bypassing ASLR.

tags | advisory
advisories | CVE-2020-6514
MD5 | 6a5a0cbe8a76c5e374b2d723099f60cd
usrsctp Stack Buffer Overflow
Posted Jul 20, 2020
Authored by Google Security Research, natashenka

There is a stack buffer overflow in usrsctp when a server processes a skipped auth block from an incoming connection. Proof of concept exploit included.

tags | exploit, overflow, proof of concept
advisories | CVE-2020-6831
MD5 | f695f6ee0ee2bf74c0b85f014497b37f
VMware ESXi Use-After-Free / Out-Of-Bounds Access
Posted Jul 17, 2020
Authored by Google Security Research, Cfir Cohen

Several security issues have been identified in the VMware ESIx virtual machine monitor (VMM). A use-after-free (UAF) vulnerability in PVNVRAM, a missing return value check in EHCI USB controller leading to private heap information disclosure, and several out-of-bounds reads.

tags | advisory, info disclosure
advisories | CVE-2020-3960, CVE-2020-3963, CVE-2020-3964, CVE-2020-3965
MD5 | d2417f8af8ebed99ebd6fdfff7a2c153
iOS / macOS Wifi Proximity Kernel Double-Free
Posted Jun 25, 2020
Authored by Google Security Research, ianbeer

iOS and macOS suffered from a wifi proximity kernel double-free vulnerability in AWDL BSS Steering.

tags | exploit, kernel
systems | ios
advisories | CVE-2020-3843, CVE-2020-9844
MD5 | cdd1c47241bd866a69b6c59cc0b23828
Node.js Hostname Verification Bypass
Posted Jun 3, 2020
Authored by Google Security Research, Felix Wilhelm

Insecure TLS session reuse can lead to a hostname verification bypass in Node.js.

tags | exploit
MD5 | 9bde5356a44eb307d096d404cbcdc1d0
JSC JIT Out-Of-Bounds Access
Posted Jun 3, 2020
Authored by saelo, Google Security Research

The DFG and FTL JIT compilers incorrectly replace Checked with Unchecked ArithNegate operations (and vice versa) during Common Subexpression Elimination. This can then be exploited to cause out-of-bounds accesses and potentially other memory safety violations.

tags | exploit
advisories | CVE-2020-9802
MD5 | 0b1a6974a8c2118b0cb88077ae99fe29
Avast Array.prototype.toString Out-Of-Bounds Copy
Posted Jun 1, 2020
Authored by Tavis Ormandy, Google Security Research

Avast suffers from an out-of-bounds copy vulnerability in Array.prototype.toString.

tags | exploit
MD5 | 59b15e0413a1cb080644249586af9699
Firefox Default Content Process DACL Sandbox Escape
Posted May 28, 2020
Authored by James Forshaw, Google Security Research

The Firefox content processes do not sufficiently lockdown access control which can result in a sandbox escape.

tags | exploit
advisories | CVE-2020-12388
MD5 | 1b90a8f7ec30889bdb9321cdf60bc14e
SecureCRT Memory Corruption
Posted May 15, 2020
Authored by Tavis Ormandy, Google Security Research

SecureCRT suffers from a memory corruption vulnerability in CSI functions.

tags | exploit
advisories | CVE-2020-12651
MD5 | e90a6d22c2cdbe99b5796b3c3e382581
Page 1 of 61
Back12345Next

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    8 Files
  • 24
    Sep 24th
    15 Files
  • 25
    Sep 25th
    4 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close