mirror of
https://github.com/TREXNEGRO/Research
synced 2026-06-21 13:45:57 +00:00
TREXNEGRO
dbb23ce6b3
Reproducer for a concurrent UAF / double-free / cross-process info leak / kernel pointer disclosure / SLUB freelist corruption in Android Common Kernel IncFS (fs/incfs/verity.c::incfs_read_signature). Root cause: function-local 'static u8 *signature;' BSS slot shared globally; two concurrent threads race on it. One-character patch included (drop the static qualifier). Status: reported to Google Android & Devices VRP 2026-05-09; closed as Won't Fix (Infeasible) 2026-06-15. The reproducer ships the runtime-confirmed primitives but NOT an end-to-end UID=0 exploit; the blockers (per-build artefacts, per-cache freelist cookie, target Pixel kernel image) are documented in the README. Companion writeup: https://trexnegro.github.io/posts/android-incfs-verity-signature-race-google-asr-infeasible/
Research
PoCs, reproducers, and supporting artifacts for the writeups at https://trexnegro.github.io.
Each subdirectory corresponds to one finding or research note and contains the minimum needed to reproduce or audit it. New entries are appended over time; older entries are not rewritten unless the upstream fix changes shape.
Index
| Finding | Class | Status | Companion writeup |
|---|---|---|---|
cifs-smb2-read-overflow/ |
Linux kernel — cifs / SMB2 client | Patched upstream (81a8742), AUTOSEL'd to stable 2026-05-20 |
u32 + u32 = 0 is still a bug in 2026 |
patchless-amsi-bypass/ |
Windows — in-process AMSI/ETW evasion | Reference port, public technique | Patchless AMSI Bypass via Hardware Breakpoints |
iscsi-chap-base64-oob/ |
Linux kernel — LIO iSCSI target CHAP auth | Patched upstream (85db7391310b), AUTOSEL'd to stable 2026-05-25 |
Found the same iSCSI CHAP base64 overflow 25 days early |
crowdstrike-logscale-waf-graphql-bypass/ |
Web — WAF URL-decode mismatch + pre-auth GraphQL | CVE-2026-40050 mitigation bypass; vendor declined report 2026-06-01 | One byte of URL-encoding past a WAF |
android-incfs-verity-signature-race/ |
Android Common Kernel — IncFS verity-signature handler | Unpatched upstream; Google ASR closed Won't Fix (Infeasible) 2026-06-15 | Android IncFS verity-signature race — and what Google ASR "Won't Fix (Infeasible)" actually means |
License
MIT. See LICENSE at the repository root.