Support WireGuard development via patreon.com/zx2c4 and wireguard.com/donations/
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jason A. Donenfeld
Re: Local information disclosure in apport and systemd-coredump
oss-sec mailing list archives From: Solar Designer <solar () openwall com> Date: Fri, 6 Jun 2025 03:49:14 +0200 On Thu, Jun 05, 2025 at 05:31:41AM +0200, Solar Designer wrote: On Tue, Jun 03, 2025 at 10:16:52AM +0200, Vegard Nossum wrote: newgrp: fix potential string injection Since newgrp is setuid-root, any write() system calls it does in order to print error messages will be done as the root user.
WordPress W3-Total-Cache 0.9.2.4 Username / Hash Extraction
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Auxiliary include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Report include Msf::Auxiliary::Scanner def initialize super( 'Name' => 'WordPress W3-Total-Cache Plugin 0.9.2.4 (or before) Username and Hash Extract', 'Description' => "The W3-Total-Cache Wordpress Plugin <= 0.9.2.4 can cache database statements...
Re: linux-distros list policy and Linux kernel
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Tue, 17 May 2022 13:10:16 +0200 Hi Seth, On Tue, May 17, 2022 at 03:30:33AM +0000, Seth Arnold wrote: I think playing CVEs with the kernel (and possibly other humongous projects too) is in large part a fool's errand.
Re: linux-distros list policy and Linux kernel
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Mon, 16 May 2022 15:12:20 +0200 Hi Alexander, I think a lot of this depends on what you feel the primary value in distros@ is. I always thought its primary purpose was to centralize embargoed vulnerability reports, using its presence as *the* de facto forum for that, in order to receive nearly all embargoed bugs.
by Jason A. Donenfeld (zx2c4), 2022-03-18 The random number generator has undergone a few important changes for Linux 5.17 and 5.18, in an attempt to modernize both the code and the cryptography used. The smaller part of these will be released with 5.17 on Sunday, while the larger part will be merged into 5.18 on Monday, which should receive its first release candidate in a few weeks and a release in a few months.
ansi escape sequence injection into ubuntu's add-apt-repository
oss-sec mailing list archives By Date By Thread Re: ansi escape sequence injection into ubuntu's add-apt-repository From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Wed, 5 Aug 2020 09:35:32 +0200 Upstream tracker bug: https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/1890286 By Date By Thread Current thread: ansi escape sequence injection into ubuntu's add-apt-repository Jason A. Donenfeld (Aug 03) Re: ansi escape sequence injection into ubuntu's add-apt-repository Jason A.
ansi escape sequence injection into ubuntu's add-apt-repository
oss-sec mailing list archives By Date By Thread ansi escape sequence injection into ubuntu's add-apt-repository From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Mon, 3 Aug 2020 16:41:37 +0200 Hi, I've found a rather low grade concern: I'm able to inject ANSI escape sequences into PPA descriptions on Launchpad, and then have them rendered by add-apt-repository *before* the user consents to actually adding that repository. There might be some sort of trust barrier issue with that.
UEFI SecureBoot bypass fixes rolled out to kernels below radar
oss-sec mailing list archives By Date By Thread UEFI SecureBoot bypass fixes rolled out to kernels below radar From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Thu, 30 Jul 2020 13:48:41 +0200 Hi, I thought I should mention that yesterday's UEFI SecureBoot bypass headlines neglected to mention the bugs I found over a month ago (with the exception of Debian's announcement, which got some details wrong initially but those have since been rectified).
lockdown bypass on ubuntu 18.04's 4.15 kernel for loading unsigned modules
oss-sec mailing list archives By Date By Thread Re: lockdown bypass on ubuntu 18.04's 4.15 kernel for loading unsigned modules From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Mon, 15 Jun 2020 17:02:05 -0600 Hi Mitre, People are requesting a CVE to track this and are poking me to poke you to assign one. Jason On Sun, Jun 14, 2020 at 12:30 AM Jason A.
lockdown bypass on mainline kernel for loading unsigned modules
oss-sec mailing list archives By Date By Thread lockdown bypass on mainline kernel for loading unsigned modules From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Mon, 15 Jun 2020 04:26:37 -0600 Hi everyone, Yesterday, I found a lockdown bypass in Ubuntu 18.04's kernel using ACPI table tricks via the efi ssdt variable [1]. Today I found another one that's a bit easier to exploit and appears to be unpatched on mainline, using acpi_configfs to inject an ACPI table.
lockdown bypass on ubuntu 18.04's 4.15 kernel for loading unsigned modules
oss-sec mailing list archives By Date By Thread lockdown bypass on ubuntu 18.04's 4.15 kernel for loading unsigned modules From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Sun, 14 Jun 2020 00:30:54 -0600 Hey folks, I noticed that Ubuntu 18.04's 4.15 kernels forgot to protect efivar_ssdt with lockdown, making that a vector for disabling lockdown on an efi secure boot machine.
Donations - WireGuard
Donations We're extremely grateful for all donations, which enable us to continue developing WireGuard as free open source software. We are happy to receive donations from interested companies who would like to see WireGuard development continue and thrive, as well as individual donations from folks who would simply like to say "thanks". By popular demand, you can now donate to WireGuard development via several means. Don't hesitate to ask us for stickers.
Potential DoS vulnerability in CGit
oss-sec mailing list archives By Date By Thread Re: Potential DoS vulnerability in CGit From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Sun, 19 May 2019 18:23:59 +0200 Hey Wire, I'm glad you emailed oss-sec, as all four of your messages went right into the gmail spam filter. Your message here caused a bunch of people to let me know on irc and sms. Really sorry about the snafoo. I'll have a close look at this and ship a patch need be during the next 24 hours.
DLL injection in Go < 1.12.2 [CVE-2019-9634]
oss-sec mailing list archives By Date By Thread DLL injection in Go < 1.12.2 [CVE-2019-9634] From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Tue, 9 Apr 2019 02:26:07 +0200 Hey folks, Golang before 1.12.2 linked against various DLLs that were same-directory injectable and generally its library loading mechanism did not use LoadLibraryEx, allowing the classic DLL injection attacks, especially with regards to executables saved to the Downloads/ folder [1].
Layer 3 TUN Driver for Windows
Nmap Development mailing list archives By Date By Thread Re: [Openvpn-devel] [ANNOUNCE] Wintun: Layer 3 TUN Driver for Windows From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Mon, 25 Mar 2019 11:37:19 +0100 Hey Arne, On Mon, Mar 25, 2019 at 11:23 AM Arne Schwabe <arne () rfc2549 org> wrote: I wish you good luck in this endeavour and welcome the prospect of having a better tun driver for Windows.
Layer 3 TUN Driver for Windows
Nmap Development mailing list archives By Date By Thread [ANNOUNCE] Wintun: Layer 3 TUN Driver for Windows From: "Jason A. Donenfeld" <Jason () zx2c4 com> Date: Fri, 22 Mar 2019 19:04:02 -0600 Hi everybody, [Cross-posting to WireGuard, OpenVPN, and Nmap/npcap mailing lists.] Simon and I are pleased to announce the start of a new project, made for WireGuard and for others too: Wintun, a layer 3 TUN driver for Windows.
Protocol & Cryptography - WireGuard
Much more information may be found in the technical whitepaper. For just a quick & dirty overview, read onward here. The following protocols and primitives are used: Any secure protocol require some state to be kept, so there is an initial very simple handshake that establishes symmetric keys to be used for data transfer. This handshake occurs every few minutes, in order to provide rotating keys for perfect forward secrecy.
CVE-2018-12356 Breaking signature verification in pass (Simple Password Store)
CVE-2018-12356 Breaking signature verification in pass (Simple Password Store)
KDE Notification URI Loading Issues
From: "Jason A. Donenfeld" Date: Mon, 5 Feb 2018 01:01:30 +0100 Hi folks, There's an interesting issue in the progress of being addressed over in KDE-land. Since it's already public, I'm told it's okay to discuss it wherever. Here's the discussion: https://phabricator.kde.org/D10188 Essentially, chat programs or the like that render remote data into notifications allow remote users to inject some limited subset of HTML, which is then rendered by the KDE notification UI.
predictably random password generation in third-party pass-compatible software, "QtPass"
From: "Jason A. Donenfeld" Date: Fri, 5 Jan 2018 21:28:11 +0100 Hi folks, "QtPass" is a separate project entirely from pass. It shares no code with "pass", the project I maintain. But, "QtPass" does endeavor to be compatible with pass. However, it is in fact a completely separate project. Best practice is probably not to stray too far from my nest to these third-party GUIs, given bugs like this one, CVE-2017-18021, a way of trivially predicting all passwords ever generated with "QtPass".
Formal Verification
The WireGuard protocol, described in the technical paper, and based on Noise, has been formally verified in the symbolic model using Tamarin. This means that there is a security proof of the WireGuard protocol. The protocol has been verified to possess the following security properties: This is joint work of Jason Donenfeld and Kevin Milner. These results are extensively discussed in the WireGuard formal verification paper. This paper is a draft work in progress, but the main results are there.
Remotely exploitable crash in dhcpcd
From: "Jason A. Donenfeld" Date: Fri, 23 Jun 2017 22:53:56 +0200 Hi Roy, I found that by sending the same exact DHCP response to two different DHCP requests on different interfaces, I was able to segfault dhcpcd. The attached patch fixes the problem, though you might want to investigate a bit further precisely why this is necessary. Regards, Jason
Defense in depth patch for rxvt-unicode
From: "Jason A. Donenfeld" Date: Thu, 18 May 2017 11:31:13 +0200 On Thu, May 18, 2017 at 4:24 AM, Marc Lehmann wrote: This sounds big, but I don't quite see the patch achieving that, as input is processed at many places, yet the patch only changes one place. The intent was to limit the bounds on the number at the very beginning of the call chain. I believe this patch does that, but if I've missed additional entry points, please let me know, and I'll roll another revision of the same technique.
Defense in depth patch for rxvt-unicode
From: "Jason A. Donenfeld" Date: Wed, 17 May 2017 13:41:32 +0200 Hello list, This email thread concerns my request to Marc to include the attached patch inside rxvt-unicode upstream. My own downstream -- Gentoo's jer@, also CCd -- won't include the patch until the agreement of upstream. Thus, it's important we come to a good conclusion. On Wed, May 17, 2017 at 3:17 AM, Marc Lehmann wrote: On Fri, May 12, 2017 at 02:18:29PM +0200, "Jason A.
terminal emulators' processing of escape sequences
Re: terminal emulators' processing of escape sequences
Integer Overflow in rxvt
Hi folks, Just a small update on this. Gentoo has moved forward with removing rxvt from our distribution [1]. I'd recommend other distributions follow, since every use case of rxvt is handled by rxvt-unicode, and rxvt has no upstream anymore, in addition to what sounds like likely more vulnerabilities.
Integer Overflow in rxvt
From: "Jason A. Donenfeld" Date: Mon, 1 May 2017 19:12:05 +0200 Hello, A CVE for this in the process of being assigned, and I'll follow up on this thread once one has been given. There exists an integer overflow in rxvt. As the upstream project is dead, there is no non-vulnerable version. Thus, I'd recommend distributions use the attached patch. Do note that rxvt is different from rxvt-unicode (urxvt), which is still maintained by an upstream and is not vulnerable to this bug.
Integer Overflow in rxvt
Re: Integer Overflow in rxvt Jason A. Donenfeld (May 01)
remote heap overflow in linux networking stack
Re: CVE request: remote heap overflow in linux networking stack
remote heap overflow in linux networking stack
Re: CVE request: remote heap overflow in linux networking stack
remote heap overflow in linux networking stack
Re: CVE request: remote heap overflow in linux networking stack
remote heap overflow in linux networking stack
CVE request: remote heap overflow in linux networking stack
alloca in inline functions can be dangerous
alloca in inline functions can be dangerous From: "Jason A. Donenfeld" Date: Mon, 10 Apr 2017 16:36:24 +0200 Hey folks, I'm not sure this is the right mailing list to discuss this matter, but hopefully it finds an audience here. I was debugging some code recently, when I found a very nasty interaction between alloca and inline functions.
Cgit XSS "vulnerability" has no CVE?
Re: Cgit XSS "vulnerability" has no CVE? Jason A. Donenfeld (Mar 07)
Cgit XSS "vulnerability" has no CVE?
At the moment, none of those example filters are XSS-safe. I think I'll likely rewrite them for the next version to use a framework for that. But there's never been any guarantee for those filters, and they've never been provided as anything but potential example filters for people to tweak and change.
oss-sec: Re: Qualys Security Advisory
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778
oss-sec: Re: Qualys Security Advisory
Re: Qualys Security Advisory - Roaming through the OpenSSH client: CVE-2016-0777 and CVE-2016-0778
oss-sec: Re: CVE Request: CGit
Re: CVE Request: CGit - Multiple vulnerabilities Jason A. Donenfeld (Jan 14)
oss-sec: CVE Request: CGit
From: "Jason A. Donenfeld" Date: Thu, 14 Jan 2016 15:21:36 +0100 Hi folks, Krzysztof Katowicz-Kowalewski from ESET, Erik Cabetas from Include Security, and myself (Jason Donenfeld) from Edge Security, have found a few vulnerabilities in CGit: 1. Reflected Cross Site Scripting & Header Injection in Mimetype Query String [Katowicz-Kowalewski] The ui-blob handler accepted a mimetype as a query string and then echoed this string verbatim back.
Local Privilege Escalation in QEMU virtfs-proxy-helper
Hi folks, Some distros make qemu's virtfs-proxy-helper binary either SUID or give it filesystem capabilities such as cap_chown. This is completely insane for a wide variety of reasons; there are quite a few ways of abusing this to elevate privileges. This commit fixes the issue in Gentoo: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=183dd7394703b49c7af441a9c4227b4b91453510 The commit message contains a TOCTOU PoC.
Local Privilege Escalation in QEMU virtfs-proxy-helper
Hi folks, Some distros make qemu's virtfs-proxy-helper binary either SUID or give it filesystem capabilities such as cap_chown. This is completely insane for a wide variety of reasons; there are quite a few ways of abusing this to elevate privileges. This commit fixes the issue in Gentoo: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=183dd7394703b49c7af441a9c4227b4b91453510The commit message contains a TOCTOU PoC.
OpenSMTPD <= 5.7.2 buffer overflow
From: "Jason A. Donenfeld" Date: Mon, 5 Oct 2015 17:00:52 +0200 Hello, As reported in [1], OpenSMTPD <= 5.7.2 has a remotely exploitable buffer overflow. This overflow requires a CVE. A PoC is attached to [1]. OpenSMTPD 5.7.3 was released with fixes, and the release notes follow below. There may be other vulnerabilities also fixed by this release. A full diff follows for analysis and additional CVE assignment, in case that is necessary.
Remotely triggerable buffer overflow in OpenSMTPD
Re: Remotely triggerable buffer overflow in OpenSMTPD Jason A. Donenfeld (Oct 05)
Remotely triggerable buffer overflow in OpenSMTPD
From: "Jason A. Donenfeld" Date: Mon, 5 Oct 2015 00:38:50 +0200 Hi folks, I'm passing the gauntlet for anyone who wants to analyze this for impact etc. There's a remotely triggerable buffer overflow in OpenBSD's OpenSMTPD -- the latest version, 5.7.2 -- reachable by sending messages with huge header lines.
Critical vulnerabilities in OpenSMTPD
Re: CVE requests: Critical vulnerabilities in OpenSMTPD
Critical vulnerabilities in OpenSMTPD
From: "Jason A. Donenfeld" Date: Fri, 2 Oct 2015 15:22:01 +0200 Hello, See this excerpt from the release notes below. Quite a few bugs. Looks like at least one of them might invalidate the openbsd.org claim, "Only two remote holes in the default install, in a heck of a long time!". CCing the OpenSMTPD mailing list (low-volume; don't worry Solar!) in case they want to chime in too.
Linux x86_64 NMI security issues
Re: Linux x86_64 NMI security issues Jason A. Donenfeld (Aug 04)
oss-sec: Re: CVE Request for OpenSSH vulnerability
CVE Request for OpenSSH vulnerability - authentication limits bypass
Re: siege: off-by-one in load_conf()
Hi folks, Chiming in on behalf of Gentoo Security Team. Bug report here, see comment 5: https://bugs.gentoo.org/show_bug.cgi?id=554914#c5 In sum, I also fail to see how this is a security issue. Does anybody make siege SUID, or give it untrusted input, or anything like that?
oss-sec: Re: CVE Request: Linux Kernel Ozwpan Driver
oss-sec mailing list archives Re: CVE Request: Linux Kernel Ozwpan Driver - Remote packet-of-death vulnerabilities From: "Jason A. Donenfeld" <Jason () zx2c4 com>Date: Sun, 31 May 2015 01:30:05 +0200Hi folks, Just providing an update on this. Several fixes for these issues have been merged. On Wed, May 27, 2015 at 4:45 PM, Jason A. Donenfeld 1.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jason A.
Contact Jason A., search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack