Public advisory hygiene: what I copy into the lab wiki

Bookmarking this for the lab wiki. You wrote «CVE, vendor URL, class in one sentence, hunt notes, link to this thread». That is the sentence I keep. If the thread slides toward a live target, lock it. I will report it. I reproduced it on lab build 1021.

@mapper

Bookmarking this for the lab wiki. You wrote «CVE, vendor URL, class in one sentence, hunt notes, link to this thread». That is the sentence

Bookmarking this for the lab wiki. «Public advisory hygiene: what I copy into the lab wiki» — specifically CVE, vendor URL, class in one sentence, hunt notes, link to this thread. Canonicalize last. Concatenate after realpath is how .. comes back. I reproduced it on lab build 1033.

@n0va

Bookmarking this for the lab wiki. «Public advisory hygiene: what I copy into the lab wiki» — specifically CVE, vendor URL, class in one sen

That is not what the listing shows. You are arguing a vibe. Good. Dated shot, version in the post. The load-bearing line: CVE, vendor URL, class in one sentence, hunt notes, link to this thread. OOB read is a leak until proven otherwise. In the notes, not in a PoC. If anyone DMs me a zip I will not open it. Hash in-thread.

I reproduced it twice before I believed you. You wrote «CVE, vendor URL, class in one sentence, hunt notes, link to this thread». That is the sentence I keep. If you wrap memcpy, I want the check on every path. Is the hang the incomplete patch, or a second bug? Pinned a comment at 0x140002233 in the listing.

@oscar

I reproduced it twice before I believed you. You wrote «CVE, vendor URL, class in one sentence, hunt notes, link to this thread». That is th

I disagree with the tone, not the bytes. «Public advisory hygiene: what I copy into the lab wiki» — specifically CVE, vendor URL, class in one sentence, hunt notes, link to this thread. Date your heap notes. 2012 grooming diagrams are history. Same class as the June thread, different binary.

Did this on ARM64 last week — same shape, different pain. «Public advisory hygiene: what I copy into the lab wiki» — specifically CVE, vendor URL, class in one sentence, hunt notes, link to this thread. Patched class only. Hunt the old immediate. Do not ask for a trigger file. I reproduced it on lab build 1383.

@resrch

Did this on ARM64 last week — same shape, different pain. «Public advisory hygiene: what I copy into the lab wiki» — specifically CVE, vendo

Call-convention guess is not evidence. Not fully convinced yet. On «Public advisory hygiene: what I copy into the lab wiki»: CVE, vendor URL, class in one sentence, hunt notes, link to this thread. OOB read is a leak until proven otherwise. In the notes, not in a PoC. Same class as the June thread, different binary.

@sbox

Not fully convinced yet. On «Public advisory hygiene: what I copy into the lab wiki»: CVE, vendor URL, class in one sentence, hunt notes, li

I tried the naive path first and wasted a morning. The load-bearing line: CVE, vendor URL, class in one sentence, hunt notes, link to this thread. If you wrap memcpy, I want the check on every path. If anyone DMs me a zip I will not open it. Hash in-thread.