Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Tavis Ormandy
Replacing uMatrix.
Options My question is could uMatrix even be possible under mv3? The main difference between mv2 and mv3 here is that it is no longer possible to block requests while you execute a callback, a so-called “blocking” web request. If you want to intercept a request, it now has to be done declaratively. That just means instead of running some javascript on every single request, you have to declare what actions you want applied in advance.
Re: AMD Microcode Signature Verification Vulnerability
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 22 Jan 2025 07:52:48 -0800 On Tue, Jan 21, 2025 at 11:38:16PM -0500, Demi Marie Obenour wrote: On Tue, Jan 21, 2025 at 06:31:31PM -0800, Tavis Ormandy wrote: It looks like an OEM leaked the patch for a major upcoming CPU vulnerability, i.e. "AMD Microcode Signature Verification Vulnerability": https://rog.asus.com/motherboards/rog-strix/rog-strix-x870-i-gaming-wifi/helpdesk_bios/ I'm not thrilled about this -...
AMD Microcode Signature Verification Vulnerability
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Tue, 21 Jan 2025 18:31:31 -0800 It looks like an OEM leaked the patch for a major upcoming CPU vulnerability, i.e. "AMD Microcode Signature Verification Vulnerability": https://rog.asus.com/motherboards/rog-strix/rog-strix-x870-i-gaming-wifi/helpdesk_bios/ I'm not thrilled about this - the patch is *not* currently in linux-firmware, so this is the only publicly available patch.
XSAVES Instruction May Fail To Save XMM Registers
XSAVES Instruction May Fail To Save XMM Registers Authored by Tavis Ormandy | Site github.com AMD Errata 1386 1 is a flaw that affects the AMD Zen 2 family of processors. The observed result of this bug is that changes to xmm or ymm extended registers during normal program execution may be unexpectedly discarded. The implications of this flaw will vary depending on the workload. This is Google's proof of concept exploit.
XGETBV Is Non-Deterministic On Intel CPUs
XGETBV Is Non-Deterministic On Intel CPUs Authored by Tavis Ormandy | Site github.com The XGETBV instruction reads the contents of an internal control register. It is not a privileged instruction and is usually available to userspace. The contents is also exposed via the xstate_bv header in the XSAVE structure. The primary use of XGETBV is determining the XINUSE flags, which allows kernels and userthread implementations to determine what CPU state needs to be saved or restored on context switch.
Troubleshooting: Terminal Lag
There’s a simple generic solution to slow startup performance: server mode. The idea is to cache a few processes in the background, then all the slow stuff will already be done, ready for you to start working immediately. XTerm doesn’t have this feature natively, but it’s not complicated, I can add it. To do this, I will use deferred mapping – that just means that a program is running, but the window is not visible yet. I tried a few solutions and found one that works well, an LD_PRELOAD library.
Re: CVE-2024-35235 cups: Cupsd Listen arbitrary chmod 0140777
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 12 Jun 2024 22:49:28 -0000 (UTC) On 2024-06-11, Zdenek Dohnal wrote: ???????? Impact Given that cupsd is often running as root, this can result in the change of permission of any user or system files to be world writable. https://github.com/OpenPrinting/cups/commit/a436956f3 This is a pretty confusing description...
Re: libarchive 3.7.4 released with 2 security fixes
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 5 Jun 2024 23:28:46 -0000 (UTC) On 2024-06-04, Alan Coopersmith wrote: https://github.com/libarchive/libarchive/releases/tag/v3.7.4 announces the release on April 26 of libarchive 3.7.4 with 2 security fixes: - rar: Fix OOB in rar e8 filter (#2135) (CVE-2024-26256) https://github.com/libarchive/libarchive/pull/2135 doesn't give details, but a detailed writeup from Trend Micro / ZDI has been posted at:...
Re: finding similar compromises (was Re: From xz to ibus: more questionable tarballs)
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Tue, 2 Apr 2024 17:41:47 -0000 (UTC) On 2024-04-02, Tavis Ormandy wrote: On 2024-04-01, HW42 wrote: Hi Jan, great that you are looking for further problems. (Just to be clear, I'm not associated with ibus in any way.) Yes, agreed. In the interests of discussing things in the open after just complaining about embargoes...
finding similar compromises (was Re: From xz to ibus: more questionable tarballs)
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Tue, 2 Apr 2024 01:51:35 -0000 (UTC) On 2024-04-01, HW42 wrote: Hi Jan, great that you are looking for further problems. (Just to be clear, I'm not associated with ibus in any way.) Yes, agreed. In the interests of discussing things in the open after just complaining about embargoes...
Re: backdoor in upstream xz/liblzma leading to ssh server compromise
oss-sec mailing list archives Re: backdoor in upstream xz/liblzma leading to ssh server compromise From: Tavis Ormandy <taviso () gmail com> Date: Sat, 30 Mar 2024 16:37:48 -0000 (UTC) On 2024-03-29, Ivan Delalande wrote: On Fri, Mar 29, 2024 at 08:51:26AM -0700, Andres Freund wrote: For which the exploit code was then adjusted: https://github.com/tukaani-project/xz/commit/6e636819e8f070330d835fce46289a3ff72a7b89 Given the activity over several weeks, the committer is either directly involved...
Re: backdoor in upstream xz/liblzma leading to ssh server compromise
oss-sec mailing list archives Re: backdoor in upstream xz/liblzma leading to ssh server compromise From: Tavis Ormandy <taviso () gmail com> Date: Sat, 30 Mar 2024 15:37:27 -0000 (UTC) On 2024-03-30, Marc Deslauriers wrote: That is the problem, having more eyes on a 0-day also means more eyes from malicious entities. Neither having an embargo nor immediately posting publicly are ideal solutions.
Re: backdoor in upstream xz/liblzma leading to ssh server compromise
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Sat, 30 Mar 2024 02:48:45 -0000 (UTC) On 2024-03-30, Marc Deslauriers wrote: On 2024-03-29 19:49, Tavis Ormandy wrote: On 2024-03-29, Marc Deslauriers wrote: I think we should have a policy that if issues are suspected to be actively exploited, that the issue goes public immediately. If even there is no patch or mitigation, there's not a lot of benefit to keeping it private.
Re: backdoor in upstream xz/liblzma leading to ssh server compromise
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Fri, 29 Mar 2024 21:54:11 -0000 (UTC) On 2024-03-29, Solar Designer wrote: I have a minor procedural question for Solar though, shouldn't this have been redirected to oss-security immediately from distros? What's the rationale for an embargo here? We don't have a clear policy for such case. Some distros list members have indeed suggested making this public ASAP.
Re: backdoor in upstream xz/liblzma leading to ssh server compromise
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Fri, 29 Mar 2024 19:55:48 -0000 (UTC) On 2024-03-29, Andres Freund wrote: Hi, After observing a few odd symptoms around liblzma (part of the xz package) on Debian sid installations over the last weeks (logins with ssh taking a lot of CPU, valgrind errors) I figured out the answer: Thanks Andres, amazing work! I have a minor procedural question for Solar though, shouldn't this have been redirected to oss-security...
Ledger.
It’s not easy to get started with ledger, and you’re probably going to have some uncommon financial arrangements that the documentation didn’t cover exactly. It could be anything, maybe something mundane like you split the utilities with a partner, but you’re the one who pays the bill?1 These things are easy to handle once you’re familiar with ledger concepts, but as nobody has the exact same arrangements as you, it’s not always a copy-and-paste situation.
Hiew Hex Editor
You’re trying to patch an executable you don’t have the source code for. The first thing you need to know is that Hiew has three main views. They are text, code and data. You can quickly flip between them without losing your place, just hit enter. Most Hiew users get into the habit of doing this frequently! Let’s take a closer look at the code view.
Reptar
Discovery I’ve written previously about a processor validation technique called Oracle Serialization that we’ve been using. The idea is to generate two forms of the same randomly generated program and verify their final state is identical. You can read more about Oracle Serialization in my previous writeup. In August, our validation pipeline produced an interesting assertion.
MOV{H,L}PS instructions can fail on Genoa (Zen 4)
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Thu, 21 Sep 2023 07:21:21 -0700 Hey, when fuzzing Genoa (AMD Zen 4) I noticed that sometimes the MOV{H,L}PS instructions don't seem to work? I asked AMD if they consider this a vulnerability, and they didn't.. so I'll just document it here for reference... Quick background, these instructions load two 32-bit packed singles from the source operand into the low (movlps) or high (movhps) 64-bits of a vector register.
mutt 2.2.12 security update
oss-sec mailing list archives mutt 2.2.12 security update From: Tavis Ormandy <taviso () gmail com> Date: Sat, 9 Sep 2023 19:00:40 -0000 (UTC) FYI, a mutt update that fixes a crash on header parsing: http://lists.mutt.org/pipermail/mutt-announce/Week-of-Mon-20230904/000056.html Tavis. -- _o) $ lynx lock.cmpxchg8b.com /\\ _o) _o) $ finger taviso () sdf org _\_V _( ) _( ) @taviso Current thread: mutt 2.2.12 security update Tavis Ormandy (Sep 09)
Hacking the Timex m851
Specifications This is the Timex m851. It uses an 8-bit Seiko SC188 CPU, has 48KB of ROM, 2KB of RAM and a 42x11 dot matrix main display. The cpu is designed for ultra-low power operation - a single battery can last 3 years! This is a big selling point for me, I don’t think they’re making consumer watches like this any more. Those pins on the side? That’s USB. Naturally, you can synchronize things like appointments, and so on (there’s a neat linux library for that).
Zenbleed
Introduction Vulnerability Exploitation Discovery Solution Conclusion If you remove the first word from the string "hello world", what should the result be? This is the story of how we discovered that the answer could be your root password! Introduction All x86-64 CPUs have a set of 128-bit vector registers called the XMM registers. You can never have enough bits, so recent CPUs have extended the width of those registers up to 256-bit and even 512-bits.
CVE-2023-20593: A use-after-free in AMD Zen2 Processors
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Mon, 24 Jul 2023 07:28:18 -0700 Hello, this is CVE-2023-20593, a use-after-free in AMD Zen2 processors.
manjaro pamac vulnerability
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Fri, 7 Jul 2023 04:44:46 -0000 (UTC) FYI, I noticed a blog post about this: https://github.com/c-skills/vala-vala-hey/blob/master/vala-vala-hey I didn't test it, but if you can't trust stealth who can you trust? :) I'm not familiar with manjaro, I dunno if it's the polkit config for their dbus service. Tavis. -- _o) $ lynx lock.cmpxchg8b.com /\\ _o) _o) $ finger taviso () sdf org _\_V _( ) _( ) @taviso Current thread:
Re: ncurses fixes upstream
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 19 Apr 2023 23:03:27 -0000 (UTC) On 2023-04-19, Jonathan Bar Or (JBO) wrote: Sure - but the question is whether it's an ncurses bug, or an Apple bug? It seems like you think it's an ncurses bug, and privileged programs should be allowed to use attacker controlled terminfo, so long as they don't query certain dangerous caps like rf?
Re: ncurses fixes upstream
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Fri, 14 Apr 2023 19:35:07 -0000 (UTC) On 2023-04-13, Mark Esler wrote: I'm curious what the attack is! ISTR that terminfo definitions can contain shell commands by design and so are generally considered trusted. I remember using this trick in an exploit once :) $ printf "exploit, iprog=/usr/bin/id,\n" | tic - $ TERM=exploit reset uid=1000(taviso) gid=1000(taviso) Tavis.
AMD Zen2 ymm registers rolling back
[lkml] [2023] [Feb] [22] [last100] Views: [wrap][no wrap] [headers] [forward] Messages in this thread First message in thread Tavis Ormandy Borislav Petkov Borislav Petkov Andrew Cooper Borislav Petkov Date Tue, 21 Feb 2023 22:40:07 -0800 From Tavis Ormandy <> Subject x86: AMD Zen2 ymm registers rolling back Hello, I'm experiencing a serious bug on AMD Zen2 that is causing registers to "roll back" to previous values after a context switch.
Ubuntu Security Notice USN-5768-1
========================================================================= Ubuntu Security Notice USN-5768-1 December 08, 2022 glibc vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM Summary: Several security issues were fixed in GNU C Library.
Evernote Web Clipper Same-Origin Policy Bypass
evernote: extension allows cross-origin iframe communication I happened to notice that the Evernote Web Clipper (3,000,000+ users) allows any website to bypass the same origin policy. https://chrome.google.com/webstore/detail/evernote-web-clipper/pioclpoplcdbaefihamjohnefbikjilc If you send a message like window.postMessage({type: \"EN_request\", name: \"EN_SerializeTo\", data: { frameName: id }), the frame DOM is collected and then posted back to the top window.
Quest for my perfect watch.
Go Retro? There have been smartwatches around since the 80s, and the specifications I’m interested in are hardly cutting edge! Perhaps the closest device to what I’m looking for is actually from 2003, the Timex m851. It’s a programmable digital watch based on the 8-bit SEIKO 88349 CPU, and 2kb of RAM. Here is the developer manual, and here is the CPU manual. Essentially, you can write “wrist apps” in S1C88 assembly, and sync it over USB with a cable.
Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
oss-sec mailing list archives Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786) From: Tavis Ormandy <taviso () gmail com> Date: Thu, 3 Nov 2022 15:36:51 -0000 (UTC) On 2022-11-02, Kurt H Maier wrote: On Wed, Nov 02, 2022 at 03:09:21PM +0100, Hanno Böck wrote: FWIW it only takes a basically trivial fuzz target on the affected function to find this bug with libfuzzer.
Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 2 Nov 2022 16:32:36 -0000 (UTC) On 2022-11-02, Alex Gaynor wrote: Got it - thanks! It seems like in the specific case of non-exploitable overflows, rust wouldn't have made too much difference (abort() vs panic())... although obviously that doesn't mean other issues wouldn't have been mitigated. Tavis.
Re: OpenSSL X.509 Email Address 4-byte Buffer Overflow (CVE-2022-3602), X.509 Email Address Variable Length Buffer Overflow (CVE-2022-3786)
oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 2 Nov 2022 11:33:50 -0000 (UTC) On 2022-11-01, Jeffrey Walton wrote: I don't know rust, so serious question - if this same buggy punycode routine had been written in rust, what would have happened? - I assume you *could* write similar logic, but perhaps the argument is that idiomatic rust discourages it? - Would rustc have been able to reason about the code well enough at compile time to error out?
Ubuntu Security Notice USN-5699-1
========================================================================== Ubuntu Security Notice USN-5699-1 October 25, 2022 glibc vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 16.04 ESM Summary: Several security issues were fixed in GNU C Library.
123elf Project Buffer Overflow
# About The 123 command is a spreadsheet application for UNIX-based systems that can be used in interactive mode to create and modify financial and scientific models. For more information, see https://123r3.net # Advisory A stack buffer overflow was reported in the cell format processing routines. If a victim opens an untrusted malicious worksheet, code execution could occur. There have been no reports of this vulnerability being exploited in the wild.
123ADV-001: Stack Buffer Overflow in Lotus 1-2-3 R3 for UNIX/Linux
Full Disclosure mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Mon, 5 Sep 2022 00:58:32 -0000 (UTC) # About The 123 command is a spreadsheet application for UNIX-based systems that can be used in interactive mode to create and modify financial and scientific models. For more information, see https://123r3.net # Advisory A stack buffer overflow was reported in the cell format processing routines. If a victim opens an untrusted malicious worksheet, code execution could occur.
Unstripping Stripped Binaries
Intro Debugging Stabs Tools Examples Parameters Usage Symbol Porting String References CFG I’ve written before about how much I enjoy vintage software. Lately I’ve been tinkering with WordPerfect for UNIX. It’s working great, combined with Lotus 1-2-3 you can have a full-featured office suite in an xterm! 😂 These are 30 year old stripped binaries that I’ve somehow managed to patch into a working state.
WordPerfect for UNIX
I found this interesting print-ad for WordPerfect for UNIX, apparently the best UNIX product of 1992! (Very) Belated congratulations Corel! However, this section intrigued me: But what if you don’t go for the GUI? Just choose the Character version, and depending on your hardware, you’ll get great-looking features rarely seen on a character terminal. Like document preview, column layout, and other important features such as easy-to-use drop down menus and easy-to-understand help screens.
Mutt mutt_decode_uuencoded() Memory Disclosure
mutt: mutt_decode_uuencoded() can read the past the of the input line In mutt_decode_uuencoded(), the line length is read from the untrusted uuencoded part without validation. This could result in including private memory in replys, for example fragments of other messages, passphrases or keys. Reproduce with the following mbox, note that these are literal 0x9f bytes. This should show some uninitialized garbage in the message.
Re: DO NOT OPEN PREVIOUS MAIL Re: [oss-security] Denial of service in GnuPG
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 6 Jul 2022 06:10:32 -0000 (UTC) On 2022-07-04, Jakub Wilk wrote: Hmm - I think you don't even need auto_decode, because x-action parameters can trigger automatic decryption in mutt.
OpenSSL 1.0.2 / 1.1.1 / 3.0 BN_mod_sqrt() Infinite Loop
The BN_mod_sqrt() function in OpenSSL versions 1.0.2, 1.1.1, and 3.0, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli.
Lotus 1-2-3 For Linux
System Calls The first problem is that Linux and UNIX do not use a compatible system call interface. UNIX uses the lcall7 interface, so we need to find those calls and fix them up.
Re: Defense in depth -- the Microsoft way (part 80): 25 (in words: TWENTY-FIVE) year old TRIVIAL bug crashes CMD.exe
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev Full Disclosure mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Thu, 12 May 2022 15:15:15 -0000 (UTC) On 2022-05-10, Stefan Kanthak wrote: They're explaining that you need privileges to attack *other* users. I don't think anyone is disputing you can "attack" yourself. I know, I know - we've had this discussion before, and nothing will convince you that this isn't a vulnerability :) Tavis.
Re: Re: zlib memory corruption on deflate (i.e. compress)
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Mon, 28 Mar 2022 06:29:46 -0700 On Sun, Mar 27, 2022 at 05:39:59PM -0700, Eric Biggers wrote: I've attached a full reproducer that works with the following parameters: level=7 (also 8 and 9) windowBits=15 memLevel=1 strategy=Z_DEFAULT_STRATEGY i.e., deflateInit2(&strm, 7, Z_DEFLATED, 15, 1, Z_DEFAULT_STRATEGY); With ASAN, it...
Re: zlib memory corruption on deflate (i.e. compress)
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Sat, 26 Mar 2022 09:52:17 -0700 On Fri, Mar 25, 2022 at 08:59:35AM -0500, John Helmert III wrote: CVE-2018-25032 appears to have been assigned for it now. Thanks, I've made some progress working on the bug. I've got a nice clean repro for Z_FIXED strategy. To hit the bug, you need to force lots of worst-case (distance, length) pairs.
zlib memory corruption on deflate (i.e. compress)
Nmap Announce Nmap Dev Full Disclosure Security Lists Internet Issues Open Source Dev oss-sec mailing list archives From: Tavis Ormandy <taviso () gmail com> Date: Wed, 23 Mar 2022 20:49:49 -0700 Greetings list, I was recently trying to track down a reproducible crash in a compressor. Believe it or not, it really was a bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs.
Ubuntu Security Notice USN-5310-1
========================================================================== Ubuntu Security Notice USN-5310-1 March 01, 2022 glibc vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in GNU C Library.
xterm buffer overflow via crafted sixel
oss-sec mailing list archives By Date By Thread Re: xterm buffer overflow via crafted sixel From: Tavis Ormandy <taviso () gmail com> Date: Sun, 30 Jan 2022 18:39:01 -0000 (UTC) On 2022-01-30, nick black wrote: an error of mine own led to emission of a corrupted sixel [0], and spectacular gyrations from XTerm: ==1426124== Invalid write of size 2 ==1426124== at 0x193FF1: set_sixel (graphics_sixel.c:181) ==1426124== by 0x1949E1: parse_sixel (graphics_sixel.c:534) ==1426124== by 0x17203D: do_dcs...
NSS Signature Validation Memory Corruption
what you don't know can hurt you
MpEngine ASProtect Embedded Runtime DLL Memory Corruption
ASProtect embeds a runtime DLL that is susceptible to memory corruption. Crash testcase provided.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Tavis
Contact Tavis, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack