~ @m00nbsd

being a jackass is important in life Joined June 2015

Tweets

73
Followers

1K
Following

0
Likes

0

Microsoft Threat Intelligence @MsftSecIntel

3 years ago

Read about kernel sanitizers, powerful detection features that can uncover bugs in kernel-mode components, and how they enable Microsoft engineering teams to identify and fix vulnerabilities earlier in the software development cycle: msft.it/6014eCpbq

1 47 88 33K 18

Trend Zero Day Initiative @thezdi

3 years ago

CVE-2022-23088: A new guest blog from @m00nbsd describes a 13-yr-old heap overflow in the Wi-Fi stack that allows network-adjacent attackers to execute code on affected installations of FreeBSD Kernel. Includes root cause & PoC. Read the details at zerodayinitiative.com/blog/2022/6/15…

5 61 167 0 31

~ @m00nbsd

3 years ago

Remote kernel heap overflow in the PlayStation 5: hackerone.com/reports/1350653

14 211 865 0 62

~ @m00nbsd

3 years ago

Kernel RCE in #FreeBSD via WiFi frames: freebsd.org/security/advis… Also affects #pfSense / #OPNsense / etc

3 107 244 0 23

~ @m00nbsd

4 years ago

SMAP bypass in the PlayStation 5: hackerone.com/reports/1048322

4 83 274 0 16

~ @m00nbsd

4 years ago

Dudes, you don't seem to have noticed there are some nicer big-ass vulns in that hypervisor. This one for example, host stack r/w overflow, full VM escape, and no, retguard does not mitigate it. #OpenBSD

OpenBSD src Changes @OpenBSD_src

4 years ago

0 3 8 0 0

1 13 57 0 1

Download Image

~ @m00nbsd

5 years ago

Ah lol so I'm not the only one who developed KASAN for #FreeBSD: cgit.freebsd.org/src/commit/?id… I didn't release my impl and rather piled up the vulns I found with it, old pic related. A lot of crazy kernel vulns.

2 3 11 0 0

Download Image

~ @m00nbsd

5 years ago

The recent ICMPv6 stuff in Windows reminded me I still had similar BSD vulns in my garage, so here we go Remote use-after-free in #OpenBSD via ICMPv6: ftp.openbsd.org/pub/OpenBSD/pa… Remote use-after-free in #FreeBSD via ICMPv6: lists.freebsd.org/pipermail/free… RCE possible in the first one.

2 28 72 0 4

~ @m00nbsd

5 years ago

Trivial VM escape in #Bhyve: if you're a guest, allocate a GPA, use a VMLOAD+RDMSR probe to determine its HPA, use SKINIT to reinit the CPU core at that HPA. The CPU core restarts and executes your instructions in host mode. That's it, you're the host.

2 47 122 0 12

Download Image

Trend Zero Day Initiative @thezdi

5 years ago

A new guest blog with an excellent analysis from @m00nbsd shows a fast and smooth privilege escalation exploit in #FreeBSD. His write-up includes PoC and a video demo. Read the details at bit.ly/3jAjnwW

1 55 108 0 8

~ @m00nbsd

5 years ago

by the way there's some real savage VM escape in #Bhyve, guest can take complete control of the host -- exploit is crazy, but easy!

2 5 13 0 0

~ @m00nbsd

5 years ago

and six months later some of them are still not fixed

Anderson Nascimento @andersonc0d3

6 years ago

and six months later some of them are still not fixed

1 21 50 0 2

1 0 4 0 0

~ @m00nbsd

5 years ago

a #FreeBSD zero day I've had for a looooooong time freebsd.org/security/advis…

4 9 53 0 3

~ @m00nbsd

6 years ago

full code exec when attaching malicious USB devices, among other #BSD surprises today

1 14 45 0 0

Download Image

~ @m00nbsd

6 years ago

I guess I should one day publish my "NetBSD Privileged Kernel" research on #NetBSD, here for example running the motherboard's SMM in a container to protect the kernel from firmware vulns and backdoors