Double-Free RCE in VLC. A honggfuzz how-to

Introduction I spent three months working on VLC using Honggfuzz, tweaking it to suit the target. In the process, I found five vulnerabilities, one of which was a high-risk double-free issue and merited CVE-2019-12874. Here’s the VLC advisory . Here’s how I found it. I hope you find the how-to...

Stable Channel Update for Desktop

The stable channel has been updated to 74.0.3729.131 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. Security Fixes and Rewards Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain...

Stable Channel Update for Desktop

The Chrome team is delighted to announce the promotion of Chrome 74 to the stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks. Chrome 74.0.3729.108 contains a number of fixes and improvements -- a list of changes is available in the log. Watch out for upcomin...

tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Exploit Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump sourc...

tcpdump < 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads

Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump source code from GitHub, compiled with AddressSanitizer: --- cut --- ...

Google Chrome < M72 - Use-After-Free in RenderProcessHostImpl Binding for P2PSocketDispatcherHost

There's an object-lifetime issue in the browser process in the handling of P2PSocketDispatcherHost binding in parallel with OnBloatedRenderer event handling. In RenderProcessHostImpl, we have a uniqueptr owning a P2PSocketDispatcherHost, which we bind to an interface using base::Unretained in...

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads

tcpdump 4.9.3 - Multiple Heap-Based Out-of-Bounds Reads Through fuzzing of network capture .pcap files, we have identified 16 crashes with unique stack traces in tcpdump. These crashes are caused by heap-based out-of-bounds memory reads, and can be reproduced with the latest tcpdump source code...

Google Chrome < M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger this by closing the browser while running the attached poc; I'm not sure if there's a...

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free

Google Chrome M72 - RenderFrameHostImpl::CreateMediaStreamDispatcherHost Use-After-Free There's a race-condition / object-lifetime issue in the browser process when the browser process shutdown races against the IO thread handling mojo messages from the renderer. It's at least possible to trigger...

[SECURITY] [DLA 1689-1] elfutils security update

Package : elfutils Version : 0.159-4.2+deb8u1 CVE ID : CVE-2017-7608 CVE-2017-7610 CVE-2017-7611 CVE-2017-7612 CVE-2017-7613 CVE-2018-16062 CVE-2018-18310 CVE-2018-18520 CVE-2018-18521 CVE-2019-7149 CVE-2019-7150 CVE-2019-7665 Several issues in elfutils, a collection of utilities to handle ELF...

openthread/cli-uart-received-fuzzer: Crash in ot::Mac::LinkRaw::IsEnabled

Project: https://github.com/openthread/openthread.git Detailed report: https://oss-fuzz.com/testcase?key=5764065970880512 Project: openthread Fuzzer: aflopenthreadcli-uart-received-fuzzer Fuzz target binary: cli-uart-received-fuzzer Job Type: aflasanopenthread Platform Id: linux Crash Type: UNKNO...

AddressSanitizer (ASan) - SUID Executable Privilege Escalation (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AddressSanitizer ASan SUID Executable Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on Linux systems usi...

AddressSanitizer (ASan) - SUID Executable Privilege Escalation Exploit

This Metasploit module attempts to gain root privileges on Linux systems using setuid executables compiled with AddressSanitizer ASan. ASan configuration related environment variables are permitted when executing setuid executables built with libasan. The logpath option can be set using the...

AddressSanitizer (ASan) SUID Executable Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AddressSanitizer ASan SUID Executable Privilege Escalation', 'Description' = %q This module attempts to gain root privileges on Linux systems usi...

PuTTY (European Commission - DIGIT): heap-use-after-free (READ of size 8) in main()

Summary: After downloading putty-0.70-2019-01-17.53747ad.tar.gz, I compiled it on Debian 9 with Clang-8.0.0 and AddressSanitizer and while trying to extract a public key from a crafted key, I triggered a heap-use-after-free in main. Description: add more details about this vulnerability Steps To...

ASAN/SUID - Local Privilege Escalation

!/bin/bash unsanitary.sh - ASAN/SUID Local Root Exploit Exploits er, unsanitized env var passing in ASAN which leads to file clobbering as root when executing setuid root binaries compiled with ASAN. Uses an overwrite of /etc/ld.so.preload to get root on a vulnerable system. Supply your own targe...

Wireshark - find_signature Heap Out-of-Bounds Read Vulnerability

The following crash due to a heap-based out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file": --- cut --- ==35788==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d0000e4400 at pc...

Stable Channel Update for Desktop

The stable channel has been updated to 70.0.3538.110 for Windows, Mac, and Linux, which will roll out over the coming days/weeks. A list of all changes is available in the log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug. The...

WebKit - WebCore::SVGTextLayoutAttributes::context Use-After-Free Exploit

Exploit for multiple platform in category dos / poc tref, feMerge, title inherit; float: right; none; 81em function jsfuzzer try var var00006 = htmlvar00002.getSVGDocument; catche try var var00162 = document.head; catche try htmlvar00015.setSelectionRange2,56; catche try...

WebKit - WebCore::SVGTRefElement::updateReferencedText Use-After-Free Exploit

Exploit for multiple platform in category dos / poc function freememory forvar i=0;i !-- ================================================================= ASan log: ================================================================= ==69919==ERROR: AddressSanitizer: heap-use-after-free on address...