Ryan 
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the … Read more
TL;DR: How to make a tiny kernel race window really large even on kernels without CONFIG_PREEMPT: use a cache miss to widen the race window a little bit make a timerfd expire in that window (which will run in an interrupt … Read more
Posted by Ryan Schoen, Project Zero In 2021, vendors took an average of 52 days to fix security vulnerabilities reported from Project Zero. This is a significant acceleration from an average of about 80 days 3 years ago. In addition … Read more
Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on … Read more
Posted by Tavis Ormandy, Project Zero This is an unusual blog post. I normally write posts to highlight some hidden attack surface or interesting complex vulnerability class. This time, I want to talk about a vulnerability that is neither of … Read more
An analysis of current and potential kernel security mitigations Posted by Jann Horn, Project Zero This blog post describes a straightforward Linux kernel locking bug and how I exploited it against Debian Buster’s 4.19.0-13-amd64 kernel. Based on that, it explores … Read more
Posted by Felix Wilhelm, Project Zero Introduction KVM (for Kernel-based Virtual Machine) is the de-facto standard hypervisor for Linux-based cloud environments. Outside of Azure, almost all large-scale cloud and hosting providers are running on top of KVM, turning it into … Read more
As someone whose day job can be summarized as “zapping rocks on Mars with a laser” and who is interested in writing speculative fiction, I know you will be shocked to learn that I have some opinions about the novel … Read more