Mastodawn

Big thanks to Tarcisio Fisher for adding a new section on Use-After-Free (UaF) in the Low Level Software Security Book!

We’d love your thoughts — comment here or open an issue https://github.com/llsoftsec/llsoftsecbook/issues

We just significantly improved the explanation of control-flow integrity (CFI) in the Low Level Software Security Book, see https://llsoftsec.github.io/llsoftsecbook/#control-flow-integrity-cfi

The new version offers clearer, more detailed explanations to help readers better understand this important security concept.

We’d love to hear your feedback — share your thoughts here or open an issue on github at https://github.com/llsoftsec/llsoftsecbook

I wrote a small, hands-on 'Arm Learning Path' on how to build a very basic exploit starting from a stack buffer overflow on AArch64, see https://learn.arm.com/learning-paths/servers-and-cloud-computing/exploiting-stack-buffer-overflow-aarch64/.
I'd like to hear what you think about it. It aims to help you understand a very basic exploitation technique, without having to know much about very low-level programming.
I'm hoping it will help to better understand other, more advanced, documents explaining exploits that (ab)use memory vulnerabilities, such as https://llsoftsec.github.io/llsoftsecbook/#memory-vulnerability-based-attacks.

This is an advanced topic for software developers interested in understanding how memory vulnerability-based exploits work on AArch64.

I just added a section on bounds checking to #LLSoftSecBook, please take a look! Feedback and contributions to this or any other part of the book are welcome! https://llsoftsec.github.io/llsoftsecbook/#bounds-checking

I just wrote a section on branch-predictor based side-channels for #LLSoftSecBook. Please take a look at https://llsoftsec.github.io/llsoftsecbook/#branch-predictor-based-side-channels. We really appreciate your feedback on this and any other content in the book.

Lucian Popescu just started an awesome chapter on compiler-introduced security vulnerabilities for #LLSoftSecBook! Please take a look! We’d really appreciate your feedback on this and any other content in the book. https://llsoftsec.github.io/llsoftsecbook/#compiler-introduced-security-vulnerabilities

I just wrote a section on JIT compiler vulnerabilities for #LLSoftSecBook, please take a look! We’d really appreciate your feedback on this and any other content in the book. https://llsoftsec.github.io/llsoftsecbook/#jit-compiler-vulnerabilities