Reproducer for a concurrent UAF / double-free / cross-process info
leak / kernel pointer disclosure / SLUB freelist corruption in
Android Common Kernel IncFS (fs/incfs/verity.c::incfs_read_signature).
Root cause: function-local 'static u8 *signature;' BSS slot shared
globally; two concurrent threads race on it. One-character patch
included (drop the static qualifier).
Status: reported to Google Android & Devices VRP 2026-05-09; closed
as Won't Fix (Infeasible) 2026-06-15. The reproducer ships the
runtime-confirmed primitives but NOT an end-to-end UID=0 exploit;
the blockers (per-build artefacts, per-cache freelist cookie, target
Pixel kernel image) are documented in the README.
Companion writeup:
https://trexnegro.github.io/posts/android-incfs-verity-signature-race-google-asr-infeasible/
Process hollowing of dllhost.exe + 2.7 KB position-independent shellcode
+ direct NtLoadDriver syscall. Eight rounds of iteration against the
Cortex XDR sync.suspicious_driver_service_creation rule family, ending in
end-to-end success with the deployed Win11 24H2 ruleset silent.
The specific signed driver, the new primitives it exposes, and the IOCTL
walkthrough are tracked separately through coordinated disclosure.
Companion post: https://trexnegro.github.io/posts/bypassing-cortex-driver-load-coverage-process-hollow-shellcode/
PDFWKRNL.sys IOCTL 0x80002014 arbitrary kernel memmove primitive,
PPL toggle on self, NtCreateProcessEx LSASS clone, in-memory MiniDump,
XOR-obfuscated output. Validated on Win11 26200. Lab/authorised use only.
Companion artifacts for the 2026-06-03 blog post.
WAF URL-decode mismatch on /api/v1/internal/* (11 path-encoding
variants documented) plus uncovered /graphql endpoint resolving
meta + installedLicense pre-auth on LogScale SaaS lightweight-ingest
nodes running 1.234.3. JAR diff between v1.234.1 and v1.235.1 shows
the code-level fix (LightweightIngestOnlyUriFilter) ships only in
1.235.x; the SaaS fleet is sitting on the WAF, not on the code fix.
Vendor declined the bounty report on 2026-06-01. Companion writeup
at https://trexnegro.github.io/posts/crowdstrike-logscale-waf-bypass-graphql-preauth/
Companion artifact for https://trexnegro.github.io/posts/found-the-same-iscsi-chap-overflow-25-days-early/
Sanitised reproducer for the Linux LIO iSCSI target CHAP BASE64 OOB
write, fixed upstream as commit 85db7391310b. Found independently
2026-05-05 but never shipped; ahossu sent the canonical fix.
Layout: poc/iscsi_chap_overflow.c (initiator that walks the Login
state machine and sends malformed CHAP_R = base64(96 bytes)),
lab/setup_iscsi.sh (LIO target config with CHAP+MD5),
logs/KASAN-vulnerable.log (example trace, build identifiers redacted).
OPSEC: author strings + workspace paths + customer references all
scrubbed before publication.
MIT-licensed (see root LICENSE).
Companion artifact for https://trexnegro.github.io/posts/patchless-amsi-bypass-hwbp/
Ships the validated subset of the technique covered in the post:
- BP_AMSI_HWBP : DR0 + VEH on amsi!AmsiScanBuffer
- BP_ETW_PATCH : DR1 + VEH on ntdll!EtwEventWrite
~500 lines of C across six files. Cross-compiles from Linux via
mingw-w64 (build.sh) into a self-test exe that calls AmsiScanBuffer on
the standard AMSI test string and asserts AMSI_RESULT_CLEAN.
Excluded from this entry (will land as separate entries once empirically
validated against current EDR products in lab):
- ntdll selective refresh from \KnownDlls
- Indirect syscalls (Hells/Halos/Tartarus gate)
OPSEC: author strings and engagement-specific notes scrubbed before
publication.
MIT-licensed (see root LICENSE).
Companion repository for the writeups at https://trexnegro.github.io.
Each subdirectory is one finding with its own README, reproducer, and
artifacts.
First entry: cifs-smb2-read-overflow — Linux kernel integer overflow
in fs/smb/client/{transport.c,smb2ops.c}, fixed upstream in mainline
commit 81a874233c305d29e37fdb70b691ff4254294c0b and AUTOSEL'd to
stable on 2026-05-20. Includes impacket-based malicious server, QEMU
lab scripts, and side-by-side KASAN traces (vulnerable ~245s stall
vs patched ~66s clean shutdown).
Companion writeup:
https://trexnegro.github.io/posts/u32-plus-u32-equals-zero-smb2-overflow/
TREXNEGRO