This can be abused on systems without SMAP to make NULL pointer

dereferences exploitable again.

source: grugq

There are several issues in drivers/char/random.c, in particular related to the behavior of the /dev/urandom RNG during and shortly after boot.

source: solar

Tons of fun stuff going on here.

Imports can be getters, which run while the instance is being built and is not in a consistent state. If the getter builds another instance for the same module, then the instances will share a WasmCompiledModule, but will have different ArrayBuffers for memory. Compiled module will reference one memory buffer. If the second memory grows, then the compiled module gets confused and relocates to OOB memory.

war-extension to crosh with process limit

network_diag has an awk command injection bug.

lamecalc should open again

source: L

A sandbox that leaks a lot of sand.

source: solar

Another AV bites the dust.

source: L

However, while real X86 processors have a maximum instruction length

of 15 bytes, QEMU’s instruction decoder for X86 does not place any
limit on the instruction length or the number of instruction prefixes.
Therefore, it is possible to create an arbitrarily long instruction
by e.g. prepending an arbitrary number of LOCK prefixes to a normal
instruction. This permits creating a basic block that spans three
pages by simply appending an approximately page-sized instruction to
the end of a normal basic block that starts close to the end of a
page.

source: grugq

(It took every ounce of strength not to call this issue “cloudbleed“)

Cloudflare did finally send me a draft. It contains an excellent postmortem, but severely downplays the risk to customers.

Incident report: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/

Further: https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/

source: HN