kqueue_workloop_ctl_internal Over Release
October 30, 2019
PDF link: kqueue_workloop_ctl_internal Over Release
Story1 Mom What Is Zero Multiplied By Infinity
January 13, 2019
Author: Qixun Zhao(@S0rryMybad) of Qihoo 360 Vulcan Team
今天我们文章介绍的是CVE-2018-8391,对应的patch commit. 这是一个关于Loop循环的越界读写漏洞,漏洞的成因十分有趣.我们都知道零乘以无限等于零,但是开发 ...
A Late Kernel Bug: Type Confusion in NECP
November 30, 2018
Author: Zhuo Liang of Qihoo 360 Nirvan Team
1 介绍Apple 对于代码开放的态度一直为广大的安全研究员们所诟病，代码更新总是扭扭捏捏滞后很多于系统发版时间。比如当前 macOS 的最新版本为 Mojave 10.14.1，而最新的代码还停留在 1 ...
Chakra JIT Loop LandingPad ImplicitCall Bypass
October 26, 2018
Author: Qixun Zhao(aka @S0rryMybad && 大宝) of Qihoo 360 Vulcan Team
前言在第一篇文章的时候,我们提到过关于回调的漏洞一般分为三种情况,其中第一种是GlobOpt阶段的|BailOutOnImplicitCall ...
Oracle WebLogic Two RCE Deserialization Vulnerabilities
October 19, 2018
Author: Zhiyi Zhang of 360 ESG Codesafe Team
前言Oracle 官方在7月份发布关键补丁更新之后，我在当月随后陆续提交了一些weblogic的不同类型漏洞，由于官方并 没有全部修复完成，本次的补丁修复了我报送的6个漏洞，其中有3个漏洞由于某些原因合 ...
Use After Free in mDNSOffloadUserClient.kext
October 7, 2018
Both Qixun Zhao of Qihoo 360 Vulcan Team and Liang Zhuo of Qihoo 360 Nirvan Team found this issue independently.
BackgroundIOKit UserClient classe ...
Edge Inline Segment Use After Free
September 15, 2018
Author:Qixun Zhao(aka @S0rryMybad && 大宝) of Qihoo 360 Vulcan Team
在今个月的微软补丁里,修复了我报告的4个漏洞,我将会一一讲解这些漏洞.因为我写的这些文章都是用我的空余时间写的,因为每天还有大量的工作和需要休息 ...
Edge InlineArrayPush Remote Code Execution
August 17, 2018
Note:Sorry for my poor English, to express exactly what I mean and avoid misunderstand,I need to write in Chinese.If someone want to translate to ...