CVE-2020–15702 Race Condition vulnerability in handling of PID by apport

Mon, 21 Jun 2021 00:00:00 +0000

Note) It’s just an English version of previous post .

Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.

In this article, I would like to give you a technical description of CVE-2020–15702 which is published recently. I discovered this vulnerability and reported it to the vendor via the Zero Day Initiative . This article is not intended to inform you of the dangers of vulnerabilities, but to share tips from a technical point of view.

CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring

Mon, 21 Jun 2021 00:00:00 +0000

Hello, I’m Shiga( @Ga_ryo_ ), a security engineer at Flatt Security Inc.

In this article, I would like to give you a technical description of CVE-2021–20226( ZDI-2021–001 ) which is published before. I discovered this vulnerability and reported it to the vendor via the Zero Day Initiative. This article is not intended to inform you of the dangers of vulnerabilities, but to share tips from a technical point of view.

An overview of the vulnerabilities and attack methods can be found at the links below. This blog will explain in a little more detail.

Linux on GMO Flatt Security Research

CVE-2020–15702 Race Condition vulnerability in handling of PID by apport

CVE-2021–20226 a reference counting bug which leads to local privilege escalation in io_uring