bcoles retweeted
Повну емуляцію апаратної платформи Nokia 6600 (NHL-10) у QEMU завершено. GSM-зв’язок працює end-to-end:
Відправка та прийом СМС
ARM → DSP → IQ → Osmocom → IQ → DSP → ARM
bcoles retweeted
💥 Introducing "Dirty Frag"
A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.
No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.
Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.
Details:
dirtyfrag.io
bcoles retweeted
Qualys Threat Research Unit (TRU) discovered CrackArmor: 9 AppArmor flaws impacting 12M+ Linux systems since 2017. These enable root access & container breakouts.
Patch your kernels now! Details: bit.ly/4s2c3O4
#Linux #Cybersecurity #CrackArmor"
bcoles retweeted
A Race Within A Race: Exploiting CVE-2025-38617 in Linux Packet Sockets.
A step-by-step guide to exploiting a 20-year-old bug in the Linux kernel to achieve full privilege escalation and container escape, plus a cool bug-hunting heuristic.
open.substack.com/pub/calif/…
bcoles retweeted
🎅mongobleed - poc for CVE-2025-14847. Leaks data from mongodb instances due to flaw in zlib message decompression. Reminiscent of heartbleed ❤️
bcoles retweeted
Local Privilege Escalation in Fedora Linux (CVE-2025-12744).
Red Hat has made this public, but patches aren't out yet. Reliable root for any local user.
Mitigation: sudo systemctl disable --now abrtd
Writeup + PoC: initblog.com/2025/abrt-root/
bcoles retweeted
Here is our 0day for kernelCTF🩸
- 82k bounty
- quickest submission ever
- all instances pwned😎
syst3mfailure.io/rbtree-fami…
Disclaimer: We apologize for abusing the red black tree family. Turning grandparents against grandchildren is only acceptable in the context of pwn😤
bcoles retweeted
An introduction to Software Defined Radios.
A thread for beginners on:
1. What a SDR is
2. What you can do with SDRs
3. How it plays a role in the security/hacking world
4. How it’s used in ham radio.
5. How to choose/buy one
6. Link to more reading material
0/21
bcoles retweeted
Big new feature in kernel-hardening-checker: now it supports checking the Linux kernel security parameters for RISC-V ⚡️ (in addition to X86_64, ARM64, X86_32, and ARM).
I've spent many weekends on this. Thanks to @_bcoles for the contribution ⭐️
github.com/a13xp0p0v/kernel-…
bcoles retweeted
Too Subtle to Notice: Investigating Executable Stack Issues in Linux Systems
huhong789.github.io/papers/y…
bcoles retweeted
KernelSnitch: Side-Channel Attacks on Kernel Data Structures
Paper by Lukas Maar et al. about using a timing side-channel for leaking addresses of exploitation-relevant kernel structures.
lukasmaar.github.io/papers/n…
bcoles retweeted
On related note, did you know, that 7z (running as admin), can browse to "PhysicalDrive0" (so \\.\PhysicalDrive0\3.Basic data partition.ntfs\Windows\System32\config\) and copy file from there? SAM is not locked, AV/EDR don't seem to give a damn :)
bcoles retweeted
🆕 Check out our latest publication on DMA attacks via SD cards! 💾
The article was written by our researcher Gesser.
➡️ swarm.ptsecurity.com/new-dog…
bcoles retweeted
I've written a post on SELinux and some public bypasses for Android kernel exploitation. It's especially relevant for Samsung and Huawei devices due to their use of hypervisors. Check it out here: klecko.github.io/posts/selin…
bcoles retweeted
Also, to temper some concern about @evilsocket recent research... His bugs are in a thing that none of you should have installed so when it's published, please just uninstall that junk. Hopefully the response of the developer shows how badly you need to remove it.
bcoles retweeted
Attacking UNIX Systems via CUPS, Part I
evilsocket.net/2024/09/26/At…
bcoles retweeted
Exciting news! 🚀 Just dropped my blogpost unveiling the universal Linux kernel LPE PoC for CVE-2024-1086 (working on v5.14 - v6.7) used for pwning Debian, Ubuntu, and KernelCTF Mitigation instances, including novel techniques like Dirty Pagedirectory 🧵
pwning.tech/nftables
bcoles retweeted
pretty cool UAF in the handling of stack expansion in kernels 6.1 - 6.4 seclists.org/oss-sec/2023/q3…
bcoles retweeted
New timing attack on Intel CPUs, a side channel Meltdown using the EFLAGS register. arxiv.org/pdf/2304.10877.pdf