0-day In-the-Wild Exploitation in 2022...so far.
summary
Project Zero’s public ledger shows 18 in-the-wild 0-days in 2022 so far, of which 9 of 18 are variants and 4 repeat 2021 bugs; concrete cases include a win32k user‑mode‑callback type confusion, an iOS IOMobileFramebuffer memcpy overflow with missing lower‑bound checks, and repeated Chromium property‑access interceptor fixes that left alternate paths exploitable. Patches often stop the exploit flow without fixing the root mistake, so recommended steps are root cause analysis, variant and patch analysis, improved detections and mitigations, and greater transparency from vendors.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:32Definition
- 2:50Project Zero
- 10:45Win32K
- 16:04IO Mobile Frame Buffer
- 19:14Chromium Bug
- 23:38Summary
- 24:46What do we do
- 26:12Patch analysis
- 28:10Transparency
- 29:36Conclusion
related talks
56mZero Days, Thousands of Nights: The Life & Times of Zero-Day Vulns and Their Exploits
53mVulnerabilities Are Ingredients And OWASP Top 10 The Seasoning- Meghan Jacquot
15mThink Zero Days Are Your Your Biggest Risk - Think Again
44mCritical Zero Days Remotely Compromise the Most Popular Real-Time OS
53mFive Years of 'Make 0Day Hard'
20mKeynote: Outsmarting IoT Defense: The Hacker's Perspective
27mExploited CVEs of 2024: Lessons for Vendors and Defenders
39mCVE 101: The Unfolding Of A Zero Day Attack