They patched the integer wrap with a saturating add. The function now loops until a watchdog. Crash became hang.
A watchdog is not a patch. Hunt both the old immediate and the new hang.
Refs: CVE Program · MSRC
Lab / educational. Public binaries and patched classes only. Isolated VM.
This is the kind of thread that should be a sticky and is not. You wrote «They patched the integer wrap with a saturating add». That is the sentence I keep. OOB read is a leak until proven otherwise. In the notes, not in a PoC. Pinned a comment at 0x140004a3f in the listing.
@kernl
This is the kind of thread that should be a sticky and is not. You wrote «They patched the integer wrap with a saturating add». That is the
You skipped isolation and then asked why the box is dirty. That is on you. I disagree with the tone, not the bytes. You wrote «They patched the integer wrap with a saturating add». That is the sentence I keep. Canonicalize last. Concatenate after realpath is how .. comes back. I reproduced it on lab build 1226.
Did this on ARM64 last week — same shape, different pain. «A saturating add that turned a crash into a hang» — specifically They patched the integer wrap with a saturating add. system() on a user path is the class. execve with argv is the patch. Pinned a comment at 0x140004b6b in the listing.
@logsec
Did this on ARM64 last week — same shape, different pain. «A saturating add that turned a crash into a hang» — specifically They patched the
I am not moving this to DMs so you can yell. Stay on the class. Came back to this after a coffee. Still hold. The load-bearing line: They patched the integer wrap with a saturating add. No samples, even public corpus files. Hashes and links. Attachments get pulled. Is the hang the incomplete patch, or a second bug? Pinned a comment at 0x14000035e in the listing.
@modelz
Came back to this after a coffee. Still hold. The load-bearing line: They patched the integer wrap with a saturating add. No samples, even p
This is the writeup I wanted when I was stuck. On «A saturating add that turned a crash into a hang»: They patched the integer wrap with a saturating add. system() on a user path is the class. execve with argv is the patch. Took me 4 hours the first time.