| https://twitter.com/IooNag |
DevOps practices are all well and good, but beware of the configuration of the tools that access your production.
I've written a blog post sharing some dangerous ways Argo CD can be configured, detailing the security impact: https://ledger.com/argo-cd-security-misconfiguration-adventures
Despite such a strong security posture, Argo CD can be configured in ways creating vulnerabilities. This article studies on two examples where Argo CD is deployed in a way which unexpectedly enabled privilege escalation and authentication bypass.
Here is how I solved all the challenges of the @grehackconf CTF teaser, using Python and Z3: https://gist.github.com/fishilico/0b69a267b73111860fe5ac668a94df2e
Hello, In current git master, several functions are calling function fe25519_abs with twice the same pointer. For example: ristretto255_sqrt_ratio_m1: libsodium/src/libsodium/crypto_core/ed25519/re...
#FlippingPages: An analysis of a new #Linux vulnerability in nf_tables and hardened exploitation techniques
https://pwning.tech/nftables/ – CVE-2024-1086
A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the #Linuxkernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different #kernel targets once.
Fix: https://kernel.dance/#f342de4e2f33e0e39165d8639387aa6c19dff660
Local privilege escalation POC: https://github.com/Notselwyn/CVE-2024-1086
A tale about exploiting KernelCTF Mitigation, Debian, and Ubuntu instances with a double-free in nf_tables in the Linux kernel, using novel techniques like Dirty Pagedirectory. All without even having to recompile the exploit for different kernel targets once.
Hello, In an Alpine Linux 3.19 containers, installing py3-z3 works fine but running import z3 in Python fails with: ModuleNotFoundError: No module named 'importlib_resources'. Installing py3-importlib-resources...
Thorsten Leemhuis (acct. 1/4)
Raphaël Rigo