Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Hello list
Irregular status update about reproducible Debian live ISO images
Roland Clobus rclobus at rclobus.nl Wed Mar 19 17:20:31 UTC 2025 Previous message (by thread): stage0-posix 1.8.0 Next message (by thread): Irregular status update about reproducible Debian live ISO images Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] Hello list, here is the 25th update of the status for reproducible Debian live ISO images [1].
Below: World Writable Directory in /var/log/below Allows Local Privilege Escalation (CVE-2025-27591)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 12 Mar 2025 12:25:33 +0100 Hello list, this is a report about a local root exploit issue in Below. We shared this report with the linux-distros mailing list on 2025-03-07 and suggested an embargo of 5 days, which ends today. Please find the full report below. We also offer a rendered version of this report on our blog [1].
pam_pkcs11: Possible Authentication Bypass in Error Situations (CVE-2025-24531)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 6 Feb 2025 15:55:18 +0100 Hello list, this report was previously sent to the linux-distros mailing list with an embargo period of 7 days, which ended today. The following report contains minor changes compared with the (draft) version shared on linux-distros. We also offer a rendered version of this report on our blog [1].
Re: dde-api-proxy: Authentication Bypass in Deepin D-Bus Proxy Service (CVE-2025-23222)
oss-sec mailing list archives From: "U.Mutlu" <um4711 () mutluit com> Date: Sun, 26 Jan 2025 17:45:37 +0100 Hi Matthias et al., I think you can post your findings also under the "Issues" link at the said github linuxdeepin project site https://github.com/linuxdeepin/dde-api-proxy/issues Best Regards U.Mutlu Matthias Gerstner wrote on 01/24/25 15:24: Hello list, following is a report about a local privilege escalation in dde-api-proxy.
dde-api-proxy: Authentication Bypass in Deepin D-Bus Proxy Service (CVE-2025-23222)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 24 Jan 2025 15:24:46 +0100 Hello list, following is a report about a local privilege escalation in dde-api-proxy. This report is also available as a rendered version on our blog [1]. 1) Introduction =============== We received a review request [2] for the Deepin api-proxy D-Bus service [3] which is part of the Deepin desktop environment [4].
Re: issue with stuck Mitre CVE requests
oss-sec mailing list archives From: Pedro Sampaio <psampaio () redhat com> Date: Wed, 22 Jan 2025 11:25:58 -0300 Hello, For CVE assignments there is no need for a Root CNA. You can request a CVE ID from any CNA which has a valid scope for the affected component/product. Root CNAs work only with other CNAs to onboard them, provide support, and mediate disputes. Red Hat works in both roles, but only the CNA is needed in this case.
issue with stuck Mitre CVE requests
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 22 Jan 2025 11:17:54 +0100 Hello list, I am currently experiencing for the second time that a CVE request submitted via the Mitre web form [1] is not receiving a response. A similar topic was already shortly discussed in the past [2]. I requested two CVEs on Jan 13. One got assigned within 24 hours, for the other one I still didn't receive a reply. The same happened to me in April 2024.
pam-u2f: problematic PAM_IGNORE return values in pam_sm_authenticate() (CVE-2025-23013)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 15 Jan 2025 13:03:49 +0100 Hello list, following is a report about problematic return values in the pam-u2f [1] module. We also offer a rendered version of this report on our blog [2]. 1) Introduction =============== The pam-u2f module allows to use U2F (Universal 2nd Factor) devices like YubiKeys in the PAM authentication stack.
Re: Linux: general protection fault in __vmx_vcpu_run with nested virtualization
oss-sec mailing list archives From: Demi Marie Obenour <demi () invisiblethingslab com> Date: Mon, 6 Jan 2025 17:07:37 -0500 On Mon, Jan 06, 2025 at 07:19:08PM +0100, Greg KH wrote: On Mon, Jan 06, 2025 at 05:01:49PM +0800, Linfeng Sun wrote: Hello list, A bug has been detected in the Linux kernel's nested virtualization implementation, which can lead to a general protection fault in __vmx_vcpu_run when running a higher version L1 hypervisor kernel on an L0 host kernel version predating the...
stalld: unpatched fixed temporary file use and other issues
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 29 Nov 2024 13:37:03 +0100 Hello list, this is a report about unfixed issues in stalld [1]. We also offer a rendered version of this report on our blog [2]. 1) Introduction =============== Stalld is a daemon that aims to prevent starvation of operating system threads on Linux. It has recently been added to openSUSE Tumbleweed and we performed a routine review the contained systemd service.
tuned: local root exploit in D-Bus method instance_create and other issues in tuned >= 2.23 (CVE-2024-52336, CVE-2024-52337)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 28 Nov 2024 10:32:09 +0100 Hello list, this is a report a about a local root exploit and some other issues in tuned [1]. We also offer a rendered version of this report on our blog [2]. 1) Introduction =============== Tuned is a privileged daemon for Linux that supports automatic tuning of various hardware and kernel settings during runtime.
authentik: remote timing attack in MetricsView HTTP Basic Auth (CVE-2024-52307)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 27 Nov 2024 14:42:09 +0100 Hello list, this report is about a remote timing attack in Authentik [1]. Authentik is a popular open source identity provider that can be self-hosted. SUSE IT is considering to use this software internally in the future and thus we have been asked to have a look at its security.
CVE-2024-47191: Local root exploit in the PAM module pam_oath.so
oss-sec mailing list archives From: Johannes Segitz <jsegitz () suse de> Date: Fri, 4 Oct 2024 12:03:44 +0200 Hello list, this is a report about a local root exploit in the PAM module `pam_oath.so`, which is shipped as part of the oath-toolkit project [1]. You can also find a rendered HTML version of this report on our blog [5]. The vulnerability was discovered by Fabian Vogt of SUSE, and this report and attached patch were authored by Matthias Gerstner of the SUSE Security Team.
Performance Co-Pilot (PCP): pmcd network daemon security issues and review results (CVE-2024-45769), (CVE-2024-45770)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 20 Sep 2024 15:11:22 +0200 Hello list, please find below a report about recently fixed security issues in PCP. You can also find a rendered HTML version of this report on our blog [13]. Best Regards Matthias 1) Introduction =============== Earlier this year we already reported a local symlink attack in Performance Co-Pilot (PCP) [1].
gnome-remote-desktop: D-Bus system service in GNOME release 46 local information leaks (CVE-2024-5148)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 24 May 2024 11:39:57 +0200 Hello list, gnome-remote-desktop [1] offers access to the graphics system either via the VNC or the RDP (Microsoft remote desktop) network protocol. Before version 46, gnome-remote-desktop was only used in the context of existing graphical user sessions.
Article: State of Sandboxing in Linux
oss-sec mailing list archives From: Ali Polatel <alip () hexsys org> Date: Mon, 20 May 2024 09:42:38 +0000 Hello list, I want to share an article I wrote on Linux Sandboxing: https://git.sr.ht/~alip/syd/tree/main/item/doc/toctou-or-gtfo.md There's nothing new in there except something I discovered on Landlock which may be a bug or a feature. TL;DR Landlock allows you to chdir into a directory that's not allowlisted.
Re: libksieve (used by kmail/kontact) sent password as username
oss-sec mailing list archives From: Salvatore Bonaccorso <carnil () debian org> Date: Tue, 30 Apr 2024 09:41:31 +0200 On Thu, Apr 25, 2024 at 06:10:54PM +0200, Jonas Schäfer wrote: Hello list, Managesieve is a protocol to configure the email filtering system Sieve via TCP/IP. It is typically authenticated just like IMAP is. The managesieve client implementation in KDE (libksieve) had a bug which used the password as username.
libksieve (used by kmail/kontact) sent password as username
oss-sec mailing list archives From: Jonas Schäfer <j.wielicki () sotecware net> Date: Thu, 25 Apr 2024 18:10:54 +0200 Hello list, Managesieve is a protocol to configure the email filtering system Sieve via TCP/IP. It is typically authenticated just like IMAP is. The managesieve client implementation in KDE (libksieve) had a bug which used the password as username. That exposed the password in plaintext server logs, as usernames are commonly logged on failed login attempts.
dnf5daemon-server: Incomplete fix of CVE-2024-1929 (CVE-2024-2746)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 3 Apr 2024 15:40:35 +0200 Hello list, CVE-2024-1929 that we previously reported [1] for the dnf5 D-Bus component has not been completely fixed. This post deals with the remaining issue we discovered. We offer this report also as a rendered HTML version on our blog [8].
dnf5daemon-server: Local root Exploit and Local Denial-of-Service in dnf5 D-Bus Components (CVE-2024-1929, CVE-2024-1930)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Mon, 4 Mar 2024 16:43:09 +0100 Hello list, please find below a report about a local root exploit and other issues in dnf5daemon-server. We also offer a rendered HTML version of the report on our blog [1]. 1) Introduction =============== The dnf5daemon-server [2] component offers a collection of D-Bus interfaces to interact with the dnf5 package manager on the system.
Performance Co-Pilot (pcp): Unsafe use of Directories in /var/lib/pcp and /var/log/pcp breaks pcp Service User Isolation (CVE-2023-6917)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 28 Feb 2024 12:33:19 +0100 Hello list, this report is about a local pcp to root user exploit in the PCP performance analysis toolkit. You can also find a rendered HTML version of this report on our blog [1].
darkhttpd: timing attack and local leak of HTTP basic auth credentials
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Tue, 23 Jan 2024 11:39:19 +0100 Hello list, this report deals with HTTP basic auth issues in the darkhttpd project [1]. Darkhttpd is a minimal HTTP web server implemented in the C programming language, for serving static files. The version under review was 1.14 [2]. A version 1.15 bugfix release [3] containing a bugfix and an additional warning message is available.
pam: pam_namespace misses O_DIRECTORY flag in `protect_dir()` (CVE-2024-22365)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 18 Jan 2024 10:50:11 +0100 Hello list, this is report about a local denial of service vulnerability in the `pam_namespace.so` PAM module. This module is part of the core PAM modules that are found in the linux-pam project [1].
budgie-extras: multiple predictable /tmp path issues in various applications
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 14 Dec 2023 13:34:05 +0100 Hello list, this report is about a range of predictable /tmp path issues in various applications in the budgie-extras [1] repository. This repository contains a range of helper applications for the Budgie desktop environment. During a routine review of applications that are autostarted in X11 environments I found the issues 1) to 4) outlined below.
Re: CVE-2023-34059 - File Descriptor Hijack vulnerability in open-vm-tools
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Mon, 27 Nov 2023 10:01:16 +0100 Hi, On Sun, Nov 26, 2023 at 11:38:50AM -0800, John Helmert III wrote: On Fri, Oct 27, 2023 at 11:57:46AM +0200, Matthias Gerstner wrote: Hello list, I want to share my full report for this finding, please find it below.
Re: CVE-2023-34059 - File Descriptor Hijack vulnerability in open-vm-tools
oss-sec mailing list archives From: John Helmert III <ajak () gentoo org> Date: Sun, 26 Nov 2023 11:38:50 -0800 On Fri, Oct 27, 2023 at 11:57:46AM +0200, Matthias Gerstner wrote: Hello list, I want to share my full report for this finding, please find it below. Introduction ============ During a routine review of the setuid-root binary "vmware-user-suid-wrapper" from the open-vm-tools [1] repository I discovered the vulnerability described in this report.
Re: hplip: security issues in `hpps` program due to fixed /tmp path usage in prnt/hpps/hppsfilter.c
oss-sec mailing list archives From: Roxana Bradescu <roxabee () chromium org> Date: Fri, 17 Nov 2023 18:09:06 -0800 Thanks for making the community aware of this issue. Perhaps security () hpe com can help to route internally to get a CVE issued and find the appropriate owners to fix. On Fri, Nov 17, 2023 at 1:38 AM Matthias Gerstner <mgerstner () suse de> wrote: Hello list, this report is about the problematic use of fixed temporary paths in the `hpps` program from the hplip [1] project.
hplip: security issues in `hpps` program due to fixed /tmp path usage in prnt/hpps/hppsfilter.c
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 17 Nov 2023 10:37:04 +0100 Hello list, this report is about the problematic use of fixed temporary paths in the `hpps` program from the hplip [1] project. Hplip is a collection of utilities for HP printer and scanner devices. There is currently no upstream fix available for this issue and this publication happens after 90 days of attempted coordinated disclosure, but upstream did not react to my report.
Security issues in passim local caching server
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 27 Oct 2023 15:25:16 +0200 Hello list, this is a report about findings in the passim [1] local caching server. 1) Introduction =============== Passim is a relatively new project for a local caching server that helps distributing publicly available files in local networks to save network bandwidth. It is a dependency of new fwupd [2] releases, which is why it has come to our attention.
Re: CVE-2023-34059 - File Descriptor Hijack vulnerability in open-vm-tools
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 27 Oct 2023 11:57:46 +0200 Hello list, I want to share my full report for this finding, please find it below. Introduction ============ During a routine review of the setuid-root binary "vmware-user-suid-wrapper" from the open-vm-tools [1] repository I discovered the vulnerability described in this report.
Cadence: Fixed /tmp path issues; no longer maintained by upstream (CVE-2023-43782, CVE-2023-43783)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 5 Oct 2023 10:04:53 +0200 Hello list, this is a report about two fixed temporary file path issues in the Cadence [1] tools for audio production. There are no upstream fixes available since the upstream author considers this project as deprecated and mostly no longer necessary. The GitHub project has consequently been archived as a response to my report of these security issues.
croc: multiple issues in file sharing utility
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 8 Sep 2023 15:37:55 +0200 Hello list, this report is about the Croc [1] file sharing utility. I have found a couple of security relevant issues in it that are not currently fixed. The upstream author doesn't have enough resources to address them on its own and wants to develop fixes in the open. Therefore I have created GitHub issues in the upstream project and publish the full report today.
openSUSE-welcome: local privilege escalation when choosing XFCE desktop layout (CVE-2023-32184)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Tue, 22 Aug 2023 12:49:03 +0200 Hello list, this report is about a local privilege escalation in the openSUSE-welcome [1] dialog. Please find the full report below. Introduction ============ openSUSE-welcome is a small Qt program that is autostarted the first time a user performs a graphical login. It presents various documentation and communication resources for the openSUSE distribution.
Mozilla VPN: CVE-2023-4104: Privileged vpndaemon on Linux wrongly and incompletely implements Polkit authentication
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 3 Aug 2023 12:08:05 +0200 Hello list, an openSUSE community packager wanted to add the Mozilla VPN client [1] to openSUSE Tumbleweed, which required a review [2] by the SUSE security team, as it contains a privileged D-Bus service running as root and a Polkit policy.
Security issue in Hotspot elevate_perf_privileges.sh (CVE-2023-28144)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Tue, 14 Mar 2023 12:41:21 +0100 Hello list, this report is about a possible security vulnerability I found in the Hotspot [1] project. An openSUSE packager for hotspot requested a review of a Hotspot update to version 1.4.1. This version contained a newly added D-Bus helper and Polkit authentication.
EternalTerminal: Review report and findings (predictable /tmp file paths and file permission issues, 3 CVEs)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 16 Feb 2023 15:56:12 +0100 Hello list, this is a report about a review of the EternalTerminal [1] codebase I performed and three CVE assignments that happened in this context. EternalTerminal is an SSH-like remote terminal solution that survives connection loss and IP roaming. Following is my detailed report which is based on the v6.2.1 upstream release.
systemd-coredump: CVE-2022-4415: local information leak due to systemd-coredump not respecting fs.suid_dumpable kernel setting
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 21 Dec 2022 12:51:24 +0100 Hello list, this is the publication of a report that was privately shared with the linux-distros mailing list on 2022-12-09 with a communicated coordinated release date of 2022-12-20. I made small changes to the report to reflect recent developments. This report is about a security issue I found in systemd-coredump.
Multiple vulnerabilities affecting UYUNI/SUSE Manager
oss-sec mailing list archives From: Paolo Perego <pperego () suse de> Date: Fri, 4 Nov 2022 17:19:45 +0100 Hello list, during a scheduled audit for the UYUNI / SUSE Manager project, three security issues were found and tracked with a CVE identifier. 1.
ceph: ceph-crash.service allows local ceph user to root exploit (CVE-2022-3650)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Tue, 25 Oct 2022 12:00:11 +0200 Hello list, this report is about a ceph user to root privilege escalation in the ceph-crash systemd service which is part of the ceph-base component of the Ceph distributed storage system project [1]. This report relates to Ceph version 16.2.9. The Vulnerability ================= The ceph-crash.service [2] runs the ceph-crash Python script [3] as root.
Warpinator remote file creation / overwrite security issue (CVE-2022-42725)
oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Mon, 24 Oct 2022 14:53:05 +0200 Hello list, this report is about a remote file creation / overwrite issue I found in Warpinator [1]. The release under review for this report was Warpinator version 1.2.13. 1) About Warpinator =================== Warpinator is a graphical application to easily transfer files between hosts on a local network in a decentralized manner.
Re: Linux: UaF due to concurrency issue in io_uring timeouts
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Mon, 8 Aug 2022 13:07:13 +0200 Hi, Jayden and David have recently published a lengthy write-up on this vulnerability, here: https://ruia-ruia.github.io/2022/08/05/CVE-2022-29582-io-uring/ and exploit here: https://github.com/Ruia-ruia/CVE-2022-29582-Exploit Alexander On Fri, Apr 22, 2022 at 06:02:58PM +0200, Salvatore Bonaccorso...
gromox: potential local privilege escalation (CVE-2022-37030)
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Filippo Bonazzi <fbonazzi () suse de> Date: Thu, 4 Aug 2022 12:38:17 +0200 Hello list, the following report describes a local privilege escalation vulnerability in Gromox[0] versions 0.5 to 1.27. Any code references in this report are based on version 1.27 in the upstream Git repository[1], and packaging references are based on the 1.27 RPM distributed by upstream[2].
Request for comment: kmod signing by AlmaLinux OS Foundation
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Igor Seletskiy <i () cloudlinux com> Date: Tue, 21 Jun 2022 10:41:22 -0700 Hello list, I have a security-related question for the Linux community at large. AlmaLinux OS is a community rebuild of RHEL 8.x & RHEL 9.x done by the non-profit AlmaLinux OS Foundation. The foundation is community-driven and done for the benefit of the community.
firejail: local root exploit reachable via --join logic (CVE-2022-31214)
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 8 Jun 2022 14:48:47 +0200 Hello list, the following report describes a local root exploit vulnerability in Firejail [1] version 0.9.68 (and likely various older versions). Any source code references in this report are based on the 0.9.68 version tag in the upstream Git repository.
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Salvatore Bonaccorso <carnil () debian org> Date: Fri, 22 Apr 2022 18:02:58 +0200 Hi David, On Fri, Apr 22, 2022 at 02:43:27AM +0200, David Bouman wrote: Hello list, We (Jayden Rivers and David Bouman) are disclosing a bug we found in the Linux kernel's io_uring subsystem.
tpm2-abrmd: possibly surprising security model for local users could result in a local DoS against TPM configuration and data
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Wed, 20 Apr 2022 11:07:00 +0200 Hello list, this is both a heads up and an invitation for discussion of a situation that some end users and TPM integrators might find surprising. The Intel TPM 2.0 software stack offers software components for accessing TPM 2.0 hardware features.
Multiple vulnerabilities in swhkd hotkey helper for Wayland
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 14 Apr 2022 12:29:36 +0200 Hello list, swhkd [1] is a pair of programs that allow to configure arbitrary keyboard hotkey definitions for the Wayland graphics system, written in the Rust programming language.
Re: ImpressCMS: from unauthenticated SQL injection to RCE
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev Full Disclosure mailing list archives From: Egidio Romano <n0b0d13s () gmail com> Date: Sat, 26 Mar 2022 02:31:15 +0100 Hello again, Just wanted to let you know I updated the blog post with some more details: apparently, this technique could be abused to bypass WAFs such as OWASP ModSecurity CRS (Paranoia Level 1) and Cloudflare, check it out! /EgiX On Wed, Mar 23, 2022 at 3:07 PM Egidio Romano <research ()...
Multiple File System Related Security Issues (CVE-2022-25326, CVE-2022-25327, CVE-2022-25328)
oss-sec mailing list archives By Date By Thread fscrypt: Multiple File System Related Security Issues (CVE-2022-25326, CVE-2022-25327, CVE-2022-25328) From: Matthias Gerstner <mgerstner () suse de> Date: Thu, 24 Feb 2022 12:33:18 +0100 Hello list, in the context of a request to include Fscrypt [1] into openSUSE Tumbleweed a routine review of the package was required, as it contains a PAM module. In the course of the review I discovered a number of file system management related security issues.
Multiple Security Issues (including remote code execution in the Agent component)
oss-sec mailing list archives By Date By Thread keylime: Multiple Security Issues (including remote code execution in the Agent component) From: Matthias Gerstner <mgerstner () suse de> Date: Fri, 28 Jan 2022 13:57:23 +0100 Hello list, I have been reviewing the Keylime TPM remote attestation solution [1] which resulted in a number of security related findings, including an arbitrary remote code execution in the Keylime Agent component.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Hello
Contact Hello, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack