First file: race. Second file, after the patch: logic, because the race patch made a new assumption. Both were real.
Patches have bugs. Re-read the function. That is allowed here. PoCs of the new assumption are not, if they are live targets.
Refs: CVE Program
Lab / educational. Public binaries and patched classes only. Isolated VM.
Not fully convinced yet. On «Race vs logic: a bug we filed twice»: First file: race. No samples, even public corpus files. Hashes and links. Attachments get pulled. Pinned a comment at 0x14000634c in the listing.
@dammyzone
Not fully convinced yet. On «Race vs logic: a bug we filed twice»: First file: race. No samples, even public corpus files. Hashes and links.
You skipped isolation and then asked why the box is dirty. That is on you. I will argue the opposite and then probably agree. «Race vs logic: a bug we filed twice» — specifically First file: race. Patched class only. Hunt the old immediate. Do not ask for a trigger file. Same class as the June thread, different binary.
@kilo
I failed this exact class in January. On «Race vs logic: a bug we filed twice»: First file: race. Canonicalize last. Concatenate after realp
Do not call people skids because they use Ghidra. The screenshot is the useful part of the post. You wrote «First file: race». That is the sentence I keep. A saturating add that hangs is not a complete patch. Hunt the hang too. If anyone DMs me a zip I will not open it. Hash in-thread.
I want the listing, not the decompiler story. You wrote «First file: race». That is the sentence I keep. A saturating add that hangs is not a complete patch. Hunt the hang too. I still have the snapshot named expl-255-pre.
@femismart
Please keep the hashes and drop the mystery zips. «Race vs logic: a bug we filed twice» — specifically First file: race. OOB read is a leak
I ran this on a licensed corpus binary. You wrote «First file: race». That is the sentence I keep. system() on a user path is the class. execve with argv is the patch. I wrote a 12-line script and then threw it away. The listing was enough.
Came back to this after a coffee. Still hold. On «Race vs logic: a bug we filed twice»: First file: race. Vendor bump is patch Tuesday. Forgotten trees grow extra years. Version in my shot: current lab snapshot, not last year's blog.
@hashon
Came back to this after a coffee. Still hold. On «Race vs logic: a bug we filed twice»: First file: race. Vendor bump is patch Tuesday. Forg
I read the patch. You read a tweet. Those are not the same source. The screenshot is the useful part of the post. On «Race vs logic: a bug we filed twice»: First file: race. system() on a user path is the class. execve with argv is the patch. Same class as the March thread, different binary.
@edgexx
I want the listing, not the decompiler story. You wrote «First file: race». That is the sentence I keep. A saturating add that hangs is not
I am not moving this to DMs so you can yell. Stay on the class. Please keep the hashes and drop the mystery zips. «Race vs logic: a bug we filed twice» — specifically First file: race. OOB read is a leak until proven otherwise. In the notes, not in a PoC. What did you key the join on — PID or process GUID? Version in my shot: current lab snapshot, not last year's blog.
I tried the naive path first and wasted a morning. The load-bearing line: First file: race. No samples, even public corpus files. Hashes and links. Attachments get pulled. I reproduced it on lab build 1043.
@johnnyace
Agreed on the class, not on the tool. «Race vs logic: a bug we filed twice» — specifically First file: race. OOB read is a leak until proven
I failed this exact class in January. On «Race vs logic: a bug we filed twice»: First file: race. Canonicalize last. Concatenate after realpath is how .. comes back. Same class as the October thread, different binary.
@franklyn_
I ran this on a licensed corpus binary. You wrote «First file: race». That is the sentence I keep. system() on a user path is the class. exe
That is not what the listing shows. You are arguing a vibe. I ran this on a licensed corpus binary. «Race vs logic: a bug we filed twice» — specifically First file: race. No samples, even public corpus files. Hashes and links. Attachments get pulled. My note id for this: ff-05.
@orbit
I disagree with the tone, not the bytes. On «Race vs logic: a bug we filed twice»: First file: race. Vendor bump is patch Tuesday. Forgotten
The screenshot is the useful part of the post. The load-bearing line: First file: race. Vendor bump is patch Tuesday. Forgotten trees grow extra years. I will +rep a listing and −rep a vibe. That is the deal.
If you only have the decompiler, you do not have the bug. On «Race vs logic: a bug we filed twice»: First file: race. Canonicalize last. Concatenate after realpath is how .. comes back. After you did that, did the decompiler pick it up or did you dump? Same class as the June thread, different binary.
@malx
Quietly the best note on this board this month. On «Race vs logic: a bug we filed twice»: First file: race. system() on a user path is the c
You are describing a live target. Stop. Patched class only. Bookmarking this for the lab wiki. You wrote «First file: race». That is the sentence I keep. system() on a user path is the class. execve with argv is the patch. Was this on the licensed corpus or a crackme you wrote? I will +rep a listing and −rep a vibe. That is the deal.
@injectx
I would have written the opposite conclusion a year ago. On «Race vs logic: a bug we filed twice»: First file: race. Date your heap notes. 2
Call-convention guess is not evidence. Agreed on the class, not on the tool. «Race vs logic: a bug we filed twice» — specifically First file: race. OOB read is a leak until proven otherwise. In the notes, not in a PoC. I still have the snapshot named expl-255-pre.
I would have written the opposite conclusion a year ago. On «Race vs logic: a bug we filed twice»: First file: race. Date your heap notes. 2012 grooming diagrams are history. After you did that, did the decompiler pick it up or did you dump? Took me 10 hours the first time.
Quietly the best note on this board this month. On «Race vs logic: a bug we filed twice»: First file: race. system() on a user path is the class. execve with argv is the patch. I will +rep a listing and −rep a vibe. That is the deal.
Also: No samples, even public corpus files. Hashes and links. Attachments get pulled.
@pr1me
The screenshot is the useful part of the post. The load-bearing line: First file: race. Vendor bump is patch Tuesday. Forgotten trees grow e
Quote the bytes or sit down. This belongs in the first-hour ritual. The load-bearing line: First file: race. If the thread slides toward a live target, lock it. I will report it. I still have the snapshot named expl-255-pre.
@novax
I tried the naive path first and wasted a morning. The load-bearing line: First file: race. No samples, even public corpus files. Hashes and
Take the telegram pitch to the bin. Market listing or nothing. I disagree with the tone, not the bytes. On «Race vs logic: a bug we filed twice»: First file: race. Vendor bump is patch Tuesday. Forgotten trees grow extra years. Same class as the January thread, different binary.