Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon.

Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver.

Slides: https://docs.google.com/presentation/d/1NulLxRowsHzgcL1AFzNF_w8nh3zk2BKKPfGi_1j76A8/edit?usp=sharing

(If you use newer Ubuntu and the code formatting looks off, use File → Print preview; @ubuntu still hasn't fixed the issues with their monospace fonts.)

CVE ID: CVE-2025-27363
Vendor: FreeType
Product: FreeType
Date Added: 2025-05-06
Vulnerability: FreeType Out-of-Bounds Write Vulnerability
Notes: This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see https://source.android.com/docs/security/bulletin/2025-05-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-27363
CVE URL: https://nvd.nist.gov/vuln/detail/CVE-2025-27363

High level diff of iOS 18.5 beta 4 vs. iOS 18.5 RC 🎉

https://github.com/blacktop/ipsw-diffs/blob/main/18_5_22F5068a__vs_18_5_22F75/README.md

#LazyWeb What is the minimum possible offset of the entry point of a PE executable inside the file?

* summoning @Ange *

We will not forget

https://truthout.org/articles/us-and-hungary-stand-alone-at-icj-in-favor-of-israels-blockade-on-gaza/

New aardwolf version 0.2.12 is out on Github and pip.
The frame decoder now has less imports and supports pyo3 with abi3 to keep it working on "all" python versions. This has the effect that 3.12 and above is now supported on Windows as well.
https://github.com/skelsec/aardwolf/releases/tag/0.2.12

The full webinar recording is out. 🔴
Watch time travel debugging in action: https://youtu.be/tEzumvwjUzo

#windows #crashanalysis #kernel

- There is no point using single letter identifiers in modern programming languages, make your names descriptive!
- `pe_mofs_to_fofs_ex`

(not sure which meme template would fit this one)

"Use TeleMessage, use Tor"

it's so fucking excruciating to watch everyone slowly get lobotomized by a dumb pile of linear algebra that burns forests to lie

[RSS] What are we on? A survey on substance use among cybersecurity professionals.

https://forms.gle/GdfVJDPnZHVz1jY67

On Google Forms of course /o\

How was it like to attend the exclusive #ZeroDayQuest event? How did a Unix #hacker even qualify in the first place? How can you become one of the #Microsoft MVRs?

Our technical director @raptor answers these and other questions in his latest article:

https://security.humanativaspa.it/my-zero-day-quest-bluehat-podcast

Happy birthday to Wolfenstein 3D, released on this day, 33 years ago on 5th May 1992!

The tech industry is a teenage industry. Rebelling against what it sees as old and uncool while desperately following fads and fashions as it tries to fit in with what everyone else is doing.

If you've ever struggled with trait/typeclass compiler errors, or if you're interested in better user interfaces for compiler diagnostics, check out our upcoming PLDI paper: "An Interactive Debugger for Rust Trait Errors"

Rust famously has good error messages. But we found that with the right interface, people become ~3x faster at identifying the root cause of a trait error. See our blog post, including a live demo in your browser:

https://cel.cs.brown.edu/blog/an-interactive-debugger-for-rust-trait-errors

“I started a spreadsheet, which is what middle-class professionals do when faced with systemic problems — we quantify things, as if converting human suffering into Excel cells might render it more manageable.” Via @gvwilson.

https://www.huffpost.com/entry/utah-school-lunch-debt-relief-free-student-meals_n_681258fbe4b03207b5ba49fa/amp

did you know that GDB includes a bytecode compiler? specifically, it has a private [edit: it's documented] bytecode format used between it and the GDB server, which the latter uses to implement conditional breakpoints with complex expressions and tracepoints

every time it hits a breakpoint/tracepoint it evaluates the bytecode, which has jumps and can read arbitrary target memory, and decides whether it really was hit or not

New post: Full Disclosure: Multiple Rundeck Job Command Injections https://insinuator.net/2025/05/full-disclosure-multiple-rundeck-job-command-injections/