每日安全动态推送(2-27)

Tencent Security Xuanwu Lab Daily News

• [Android] The code that wasn’t there: Reading memory on an Android device by accident:
https://github.blog/2023-02-23-the-code-that-wasnt-there-reading-memory-on-an-android-device-by-accident/

   ・ 安全研究员Man Yue Mo通过分析调试时出现的GPU执行错误，发现了一个由于CPU缓存和物理内存不一致导致的信息泄露漏洞，该漏洞通过读取物理内存中的脏数据导致可以泄露用户态、内核数据，本文中介绍了一种如何利用该漏洞绕过KASLR 的方法。 – P4nda

• [Crypto] Espressif ESP32: Bypassing Flash Encryption (CVE-2020-15048):
https://raelize.com/blog/espressif-systems-esp32-bypassing-flash-encryption/

   ・ 绕过 ESP32 芯片的 Flash 加密功能 – WireFish

• [Tools] Command-line Git information tool written in Rust:
https://github.com/o2sh/onefetch

   ・ 一个可以显示Git仓库详细信息的工具，可以离线使用。 – Atum

• [Web] How I found DOM-Based XSS on Microsoft MSRC and How they fixed it:
https://m3ez.medium.com/how-i-found-dom-based-xss-on-microsoft-msrc-and-how-they-fixed-it-8b71a6020c82

   ・ 微软MSRC官网的XSS漏洞的发现过程。 – Atum

• [Pentest] Introduction to Horus — Part 1:
https://medium.com/nethermind-eth/introduction-to-horus-part-1-fbc16af3ba67

   ・ 一个合约的形式化认证工具。 – Atum

• Bypassing PatchGuard at runtime:
https://hexderef.com/patchguard-bypass

   ・ 不使用 EFI bootkit，通过开启内核调试模式来关闭 windows 的 PatchGuard – WireFish

• Detecting Server-Side Prototype Pollution:
https://www.intruder.io/research/server-side-prototype-pollution

   ・ 一种黑盒检测原型链污染的方法。 – Atum

* 查看或搜索历史推送内容请访问：
https://sec.today

* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab

原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(2-27)