Attacking the VM Worker Process

In the past year we invested a lot of time making Hyper-V research more accessible to everyone. Our first blog post, “First Steps in Hyper-V Research”, describes the tools and setup for debugging the hypervisor and examines the interesting attack surfaces of the virtualization stack components. W...

Attacking the VM Worker Process

In the past year we invested a lot of time making Hyper-V research more accessible to everyone. Our first blog post, “First Steps in Hyper-V Research”, describes the tools and setup for debugging the hypervisor and examines the interesting attack surfaces of the virtualization stack components. W...

ffmpeg:ffmpeg_AV_CODEC_ID_THP_fuzzer: Heap-buffer-overflow in ljpeg_decode_rgb_scan

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=5763147314495488 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDTHPfuzzer Job Type: libfuzzerasanffmpeg Platform Id: linux Crash Type: Heap-buffer-overflow WRITE 1 Crash Address:...

skia:sksl2spirv: Heap-buffer-overflow in SkSL::FunctionDeclaration::determineFinalTypes

Project: https://skia.googlesource.com/skia.git Detailed Report: https://oss-fuzz.com/testcase?key=5736337256218624 Project: skia Fuzzing Engine: libFuzzer Fuzz Target: sksl2spirv Job Type: libfuzzerasanskia Platform Id: linux Crash Type: Heap-buffer-overflow READ 8 Crash Address: 0x6030000006f8...

ntp:fuzz_ntpd_receive: Use-of-uninitialized-value in receive

Detailed Report: https://oss-fuzz.com/testcase?key=5684730627883008 Project: ntp Fuzzing Engine: libFuzzer Fuzz Target: fuzzntpdreceive Job Type: libfuzzermsanntp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: receive fuzzntpdreceive.c fuzzntpdreceive.c...

ntp:fuzz_ntpd_receive: Use-of-uninitialized-value in process_control

Detailed Report: https://oss-fuzz.com/testcase?key=5649397106343936 Project: ntp Fuzzing Engine: libFuzzer Fuzz Target: fuzzntpdreceive Job Type: libfuzzermsanntp Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: processcontrol receive fuzzntpdreceive.c...

matio:matio_fuzzer: Use-of-uninitialized-value in psnip_safe_size_mul

Project: git://git.code.sf.net/p/matio/matio Detailed Report: https://oss-fuzz.com/testcase?key=5701145254690816 Project: matio Fuzzing Engine: libFuzzer Fuzz Target: matiofuzzer Job Type: libfuzzermsanmatio Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

libssh2:ssh2_client_fuzzer: Crash in _libssh2_packet_add

Project: https://github.com/cmeister2/libssh2.git Detailed Report: https://oss-fuzz.com/testcase?key=5670522204979200 Project: libssh2 Fuzzing Engine: libFuzzer Fuzz Target: ssh2clientfuzzer Job Type: libfuzzerasanlibssh2 Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x61110004e7ff...

curl:curl_fuzzer_pop3: Use-of-uninitialized-value in dprintf_formatf

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5716063639044096 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerpop3 Job Type: libfuzzermsancurl Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

curl:curl_fuzzer_rtmp: Negative-size-param in fuzz_tlv_to_string

Project: https://github.com/curl/curl.git Detailed Report: https://oss-fuzz.com/testcase?key=5639027763445760 Project: curl Fuzzing Engine: libFuzzer Fuzz Target: curlfuzzerrtmp Job Type: libfuzzerasani386curl Platform Id: linux Crash Type: Negative-size-param Crash Address: Crash State:...

Applepie - A Hypervisor For Fuzzing Built With WHVP And Bochs

Hello! Welcome to applepie! This is a tool designed for fuzzing, introspection, and finding bugs! This is a hypervisor using the Windows Hypervisor Platform API present in recent versions of Windows specifically this was developed and tested on Windows 10 17763. Bochs is used for providing deep...

wireshark:fuzzshark_ip: Heap-use-after-free in wmem_str_hash

Detailed Report: https://oss-fuzz.com/testcase?key=5654423381999616 Project: wireshark Fuzzing Engine: libFuzzer Fuzz Target: fuzzsharkip Job Type: libfuzzerasanwireshark Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x60200218c390 Crash State: wmemstrhash wmemmaplookup...

llvm:llvm-dwarfdump-fuzzer: Heap-buffer-overflow in llvm::DWARFFormValue::dump

Detailed report: https://oss-fuzz.com/testcase?key=5629811638140928 Project: llvm Fuzzing engine: libFuzzer Fuzz target: llvm-dwarfdump-fuzzer Job Type: libfuzzerasanllvm Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x619000001dd0 Crash State: llvm::DWARFFormValue::du...

libxslt/xpath: Crash in xmlXPathCompileExpr

Project: https://gitlab.gnome.org/GNOME/libxslt.git Detailed report: https://oss-fuzz.com/testcase?key=5702070090334208 Project: libxslt Fuzzer: libFuzzerlibxsltxpath Fuzz target binary: xpath Job Type: libfuzzerubsanlibxslt Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7fccc6e37fd...

The Fully Remote Attack Surface of the iPhone

Posted by Natalie Silvanovich, Project Zero While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as...

macOS iOS JavaScriptCore - Loop-Invariant Code Motion (LICM) Leaves Object Property Access Unguarded

macOS iOS JavaScriptCore - Loop-Invariant Code Motion LICM Leaves Object Property Access Unguarded While fuzzing JavaScriptCore, I encountered the following modified and commented JavaScript program which crashes jsc from current HEAD and release...

Google Triples Some Bug Bounty Payouts

Google is upping the ante for its Chrome bug bounty rewards program, doubling payouts from $15,000 to $30,000 for “high-quality” reports. It is also tripling baseline payouts for Chrome to $15,000. The bug-bounty pay raise is part of Google’s Chromium open-source project, which supplies the vast...

honggfuzz vulnerability mining technology principle analysis-vulnerability warning-the black bar safety net

Google AFLWinAFL, the libfuzzer and honggfuzz is the most famous of the three based on code coverage fuzzer is. Online on the AFLWinAFLanalysis of the articles more, and on the latter two Analysis Articles less. Before the spring brother has written about honggfuzz article: honggfuzz vulnerabilit...

jsonnet/convert_jsonnet_fuzzer: Crash in Interpreter::evaluate

Project: https://github.com/google/jsonnet.git Detailed report: https://oss-fuzz.com/testcase?key=5706027058593792 Project: jsonnet Fuzzer: libFuzzerjsonnetconvertjsonnetfuzzer Fuzz target binary: convertjsonnetfuzzer Job Type: libfuzzerubsanjsonnet Platform Id: linux Crash Type: UNKNOWN READ Cra...

Echidna - Ethereum Fuzz Testing Framework

Echidna is a weird creature that eats bugs and is highly electrosensitive with apologies to Jacob Stanley More seriously, Echidna is a Haskell library designed for fuzzing/property-based testing of EVM code. It supports relatively sophisticated grammar-based fuzzing campaigns to falsify a variety...