patch-diffing-in-the-dark's Introduction

Patch Diffing In The Dark

A series of blog posts leveraging CVE analysis and patch diffing to discover new vulnerabilities.

As revealed in the blog posts, the following 4 CVEs came from the in-depth study of CVE-2021-1657.

CVE Mapping

CVE	Description	Type	Blog Reference
CVE-2022-26916	Windows Fax Compose Form RCE	Heap Buffer Overflow via Integer Overflow	Found
CVE-2022-26917	Windows Fax Compose Form RCE	Heap Buffer Overflow via Integer Overflow	CVE-2021-XXXX
CVE-2022-26918	Windows Fax Compose Form RCE	Deserialization of Untrusted Data	CVE-2021-ZZZZ
CVE-2022-26926	Windows Address Book RCE	Heap Buffer Overflow via Integer Overflow	CVE-2021-YYYY

Background

This research was performed by a CSE Vulnerability Researcher under CSE's mandate to discover vulnerabilities and protect Canadian Government Networks and Systems. This research resulted in the discovery of several vulnerabilities which were reviewed as per CSE's Equities Management Framework and submitted to Microsoft's Security Response Center. The findings were published as CVE-2022-26917, CVE-2022-26917, CVE-2022-26918, and CVE-2022-26926. This work demonstrates just one method of vulnerability discovery from start to finish. If this type of work interests you, consider applying to CSE's VRC. Complete CSE's general application and select “Vulnerability Research Engineer” as the job type. If you have any questions or wish to provide additional information for your application, please email [email protected] (PGP Key).

Recommend Projects

kara-4search / patch-diffing-in-the-dark Goto Github PK