flawopen.com/パッチ解析
一般的なセキュリティ速報は、曖昧な記述や難解なバイナリリバースエンジニアリングで溢れています。当サイトの解析では、脆弱性を引き起こした実際の 5〜10 行の高水準ソースコードを特定し、直感的な比喩でバグの本質を解き明かし、実践的なセキュアコーディング規則を提供します。
How an asynchronous ring buffer registration race in fs/io_uring.c freed active kernel pages, allowing unprivileged local attackers to overwrite cred structures and achieve root.
How an improper verdict handling bug in net/netfilter/nf_tables_api.c caused double reference drops on network packets, enabling container root breakouts.
How Ubuntu-specific modifications to OverlayFS skipped permission checks during inode copy-up, allowing unprivileged containers to forge root setuid binaries.
How an off-by-one calculation in Glibc's syslog logging routine allowed local users to overwrite heap buffers via su or sudo, achieving root privileges.
How an asynchronous cryptographic callback race condition in net/tls/tls_sw.c freed network pages while still queued for zero-copy transmission.
How an unvetted socket creation flags validation bug in security/apparmor/net.c allowed sandboxed snap processes to create arbitrary raw network sockets.
How an actively exploited transaction descriptor refcount overflow in drivers/android/binder.c allowed malicious apps to escalate to full root privileges.
How an unchecked ring-buffer boundary read in Qualcomm's kgsl GPU driver allowed targeted mobile spyware to corrupt Android kernel memory.
How an unsigned integer wrap during H.264 NAL unit length decoding in libstagefright enabled zero-click remote code execution via video files.
How an unlocked page table teardown in drivers/gpu/arm/midgard/mali_kbase_mem.c enabled commercial spyware to bypass Android sandboxes.
How an unvetted nested PendingIntent in Android's ActivityManagerService allowed unprivileged apps to launch internal non-exported activities.
How an unchecked fragmentation boundary mismatch in system/bt/stack/l2cap enabled zero-click remote code execution over Bluetooth.
How incomplete Transfer-Encoding chunk extension parsing in deps/llhttp caused HTTP request desynchronization, enabling cache poisoning and credential theft.
How accessing low-level C++ internal bindings via process.binding('fs') bypassed the experimental --permission --allow-fs-read flags.
How unvetted carriage return characters in HTTP header values allowed attackers to split outgoing HTTP requests in Node.js globalThis.fetch().
How implicit cmd.exe invocation during child_process.spawn() on Windows allowed arbitrary command execution when invoking .bat or .cmd files.
How an aggregated API server context desync in k8s.io/apiserver allowed namespace-limited users to bypass RBAC and execute cluster-admin actions.
How unvetted multiline annotations in Kubernetes ingress-nginx allowed developers with ingress rights to inject arbitrary Lua directives and exfiltrate secrets.
How insecure named pipe security descriptors on Windows worker nodes in pkg/kubelet/winstats allowed container processes to impersonate NT AUTHORITY\SYSTEM.
How an internal /proc/self/cwd file descriptor leak in libcontainer/init_linux.go allowed container processes to break out to the host filesystem across Docker and Kubernetes.
How a 32-bit integer addition wrap-around in dwmcore.dll allocated undersized heap chunks exploited in the wild by ransomware, and the safe arithmetic fix.
How property getter transitions in V8's Turbofan compiler tricked optimized native code into reading raw pointers as floats, yielding in-the-wild code execution.
How JavaScriptCore's DFG JIT compiler stripped type tags without verification, allowing targeted spyware to bypass Pointer Authentication (PAC) on iOS and macOS.
How a domain acquisition by a redirect syndicate turned a trusted JavaScript CDN into an evasion-heavy malware injector targeting mobile users, and why Subresource Integrity (SRI) failed.
How a case-insensitive filesystem collision on Windows and macOS allowed a malicious repository to trick Git into writing executable hooks directly into .git/hooks/ upon clone, and the 6-line C patch that fixed it.
Obfuscated Autotools m4 macros in release tarballs decoding hidden binaries from test files, hooking GNU IFUNC symbol resolution to intercept OpenSSL's RSA decryption inside sshd.
Line-by-line teardown of the missing payload length bounds check in tls1_process_heartbeat() that leaked server private keys and session cookies, and the 4-line C bounds check fix.
How an unescaping loop in sudoers.c skipped past the null string terminator when given trailing backslashes, overflowing heap chunks to achieve instant root privilege escalation.
How HTTP parameter binding on Java 9+ traversed class.module.classLoader into Tomcat's AccessLogValve to drop an executable webshell onto the server filesystem.