krf

KRF KRF is a K ernelspace R andomized F aulter. It currently supports the Linux and FreeBSD kernels. What? Fault injection is a software testing technique that involves inducing failures "faults" in the functions called by a program. If the callee has failed to perform proper error checking and...

distributed-system-testing

Distributed Systems Testing Skills Two skills for AI coding agents that design and run claim-driven tests for distributed and stateful systems. Together they produce a structured Markdown test plan and a findings report with 10-state verdicts and an explicit SUT / harness / checker / environment...

phywhispererusb

PhyWhisperer-USB What is this thing? This is a hardware trigger for FI or SCA, which triggers on the USB phy. Be sure to read the documentation at http://phywhispererusb.readthedocs.io/ as well! If you are getting started, there are a few demonstration notebooks showing how to: Sniff Data Stream...

Fault-Injection-Finder

Fault Injection Finder ▄▖ ▜ ▗ ▄▖ ▘ ▗ ▘ ▄▖▘ ▌ ▙▖▀▌▌▌▐ ▜▘ ▐ ▛▌ ▌█▌▛▘▜▘▌▛▌▛▌ ▙▖▌▛▌▛▌█▌▛▘ ▌ █▌▙▌▐▖▐▖ ▟▖▌▌ ▌▙▖▙▖▐▖▌▙▌▌▌ ▌ ▌▌▌▙▌▙▖▌ ▙▌ Geeoon Chung and Nate Snyder This repository is the software side of our fault injection attack project. For the hardware side, check out this repo. Overall Project The...

chaos-mesh

Chaos Mesh is an open source, cloud-native Chaos Engineering platform for Kubernetes. It uses Kubernetes custom resources to define, orchestrate, and observe controlled fault injection against workloads, infrastructure, cloud services, and applications. Chaos Mesh is a Cloud Native Comp...

chaosblade

BLADE AI Languages: 中文 | English Kubernetes chaos-engineering AI agent — describe a fault in plain English or Chinese, no need to memorize CLI flags. BLADE AI is the orchestration layer on top of ChaosBlade: the agent understands intent, runs four-layer safety review, drives the injection, verifi...

PUB-A-511307188

In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PUB-A-511003301

In getsecurebootmode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Starlink-FI

Starlink User Terminal Modchip This repository accompanies the talk titled "Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal". A slide deck is available here, a recording of the talk should be available soon. The talk covers how we managed to execu...

powerfulseal

PowerfulSeal PowerfulSeal injects failure into your Kubernetes clusters, so that you can detect problems as early as possible. It allows for writing scenarios describing complete chaos experiments. Embrace the inevitable failure. Embrace The Seal. Documentation Please refer to the Powerfulseal...

CLEANSTART-2024-SU62102 Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa

Security vulnerability affects the wolfssl package. Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa...

v0ltpwn

V0LTpwn V0LTpwn CVE-2019-11157 is a software-controlled fault attack on x86 processors. It is the first attack corrupting the integrity of SGX enclaves. Description All recent Intel processors exhibit a software interface for controlling core voltages without rebooting the system. This feature is...

Silent Blindness: Fault Vulnerability of Hardware Malware Detectors

Hardware malware detectors HMDs classify hardware performance-counter measurements to identify malicious execution. Faults in their decision logic or parameters can weaken detection and allow malware to be classified as benign. We investigate this vulnerability through structural fault injection...

Astra Linux – vulnerability in linux-5.10, linux, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: quota: fix warning in dqgrab The issue occurs as follows during do fault injection: WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquotdisable+0x13b7/0x18c0 Modules linked in: CPU: 1 PID: 14870 Comm: fsconfig Not...

Astra Linux – vulnerability in linux-6.1, linux-5.10

In the Linux kernel, the following vulnerability has been resolved: ieee802154: Avoid calling WARNON on -ENOMEM in cfg802154switchnetns It is pointless to call WARNON in cases where allocation fails in devchangenetnamespace and devicerename, as it only results in useless splats caused by delibera...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: regulator: core: Fix resource leak in regulatorregister I received some reports of resource leaks during fault injection tests: - ERROR: Memory leak; expected refcount 1 instead of 100 - ofnodeget/ofnodeput unbalanced – destro...

Astra Linux – vulnerability in linux-5.10, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: thermal/core: Fix memory leak in thermalcoolingdeviceregister I observed a memory leak during a fault injection test: unreferenced object 0xffff888010080000 size 264312: comm "182", pid 102533, jiffies 4296434960 age 10.100s hex...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: removing an entry instead of using null-ptr-dereference in ocfs2xaremove Syzkaller can trigger null-ptr-dereference in ocfs2xaremove: 57.319872 a.out,1161,7:ocfs2xaremove:2028 ERROR: status = -12 57.320420...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: brd: Automatic disk creation is deferred until module initialization succeeds. My colleague Wupeng identified the following issues during fault injection: BUG: Unable to handle page faults for address: fffffbfff809d073 PGD:...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: blk-mq: Fixed a possible memory leak when registering the ‘hctx’ variable failed. There is one issue that arises during fault injection tests: An unreferenced object with a size of 512 bytes: bash comm "insmod", pid 308021,...