The Mummy 2018 – Microsoft Accidentally Summons Back Ugly Attacks from the Past
summary
Windows' IP ID generator has a trivial init bug: a random table alloc is 0x8000 bytes but only eight bytes get filled, leaving uninitialized kernel memory in the table. That lets an attacker perform key recovery (reconstruct the 40-byte hash key from many IP-ID samples), then leak up to 0x8000 bytes of kernel memory and predict IP IDs for other IP paths. Demonstrations show memory extraction and practical TCP-injection/interception and fragmentation DoS; Microsoft patches it (disclosed then fixed Oct 1).
AI-written summary · about
chapters (4)
related talks
51mHey Man, Have You Forgotten To Intialize Your Memory?
25mData-Only Pwning Microsoft Windows Kernel
45mThe Code Behind The Vulnerability
58mThe Code Behind The Vulnerability
50mExploiting the Hyper-V IDE Emulator to Escape the Virtual Machine
52mA New CVE-2015-0057 Exploit Technology
01h 00mIntroduction to memory exploitation
33mOver the Edge: Silently Owning Windows 10's Secure Browser