google/security-research
View on GitHub ↗ ★ 4,725 C
This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
31 mentions on Hacker News by 28 people: 14 stories, 17 comments · first 2020-08-10 · latest 2026-08-14
20082026
-
…and it also works on newer CPUs than the one that the attack described in the OP targets. https://github.com/google/security-research/tree/master/pocs...
comment by nspaced · 2026-08-14 · in Spaghettifying DRAM -
They still do! AMD Zen cores use RISC86, I documented it a little bit here: https://github.com/google/security-research/blob/master/pocs...
comment by taviso · 2026-08-13 · in Hardware backdoors in some x86 CPUs -
You can denoise it: https://github.com/google/security-research/security/advisor...
comment by boywitharupee · 2026-05-31 · in Cloudflare Turnstile requiring fingerprintable WebGL -
…execution == root. Only thing that's new is some people started making websites for their LPEs. https://github.com/google/security-research/tree/master/pocs...
comment by bjackman · 2026-05-08 · in Dirty Frag: Universal Linux LPE -
Can’t find the pdf, but it’s all related to the zentool stuff: https://github.com/google/security-research/blob/master/pocs... Tavis spells it out there pretty quickly: “ The simplest instructions (add, sub, mov, etc) are all implemented…
comment by lolsowrong · 2026-03-29 · in Linux is an interpreter -
…be disabling user namespaces, which is probably a good idea if they are inundated with exploits: https://github.com/google/security-research/commit/7171625f5...
comment by singron · 2025-05-30 · in Beating Google's kernelCTF PoW using AVX512 -
▲ 93
Oracle VM VirtualBox – VM Escape via VGA Devicestory by serhack_ · 2025-05-15 · 47 comments
-
…notices something and changed up the microcode? Some clarification on that part would be nice. [1] https://github.com/google/security-research/security/advisor...
comment by BonusPlay · 2025-03-05 · in Zentool – AMD Zen Microcode Manipulation Utility -
▲ 236
Zentool – AMD Zen Microcode Manipulation Utilitystory by taviso · 2025-03-05 · 66 comments
-
Hot off the presses: https://github.com/google/security-research/security/advisor...
comment by p_ing · 2025-02-03 · in Remote Code Execution in Marvel Rivals Game -
▲ 287
AMD: Microcode Signature Verification Vulnerabilitystory by todsacerdoti · 2025-02-03 · 105 comments
-
▲ 14
PlayStation Portal (Remote Play): Stack-buffer overflow in HEVC decoderstory by skilled · 2024-06-14 · 2 comments
-
…store duopoly, which is even less diverse. [1] https://news.ycombinator.com/item?id=38919389 [2] https://github.com/google/security-research/blob/master/v8ct... [3] https://bughunters.google.com/about/rules/5745167867576320/c...
comment by throwitaway1123 · 2024-01-10 · in Things engineers believe about Web development -
…https://github.com/gsliepen/tinc/issues/218 [2]: https://github.com/slackhq/nebula/issues/637 [3]: https://github.com/google/security-research/security/advisor...
comment by nh2 · 2023-10-14 · in Would we still create Nebula today? -
You can run the PoC if you want to check: https://github.com/google/security-research/tree/master/pocs...
comment by jeroenhd · 2023-07-26 · in Staying ahead of the AMD vulnerability known as “Zenbleed” -
…leaked customer secrets. [1] https://www.wiz.io/blog/azure-active-directory-bing-misconfi... [2] https://github.com/google/security-research/security/advisor... [3] https://blog.lastpass.com/2023/03/security-incident-update-r... [4]…
comment by e1g · 2023-06-03 · in Ask HN: Real-life, ridiculous security incidents? -
▲ 18
Linux Kernel Spectre v2 SMT mitigationsstory by zx8080 · 2023-04-16 · 6 comments
-
▲ 25
Linux Kernel: Bypassing Spectre-BTI User Space Mitigationsstory by todsacerdoti · 2023-02-05 · 1 comment
-
▲ 5
Unsandboxed Password Managerstory by mgerdts · 2023-01-21 · 1 comment
-
▲ 337
VSCode remote code execution advisorystory by dijit · 2022-12-07 · 178 comments
-
▲ 2
Visual Studio Code: Remote Code Executionstory by robin_reala · 2022-12-02 · 0 comments
-
▲ 1
Remote code execution in Linux kernel Bluetooth stack. Affected since 2013story by lknik · 2022-11-30 · 0 comments
-
▲ 1
Linux Kernel: UAF in Bluetooth L2CAP Handshake · Advisorystory by transpute · 2022-11-30 · 0 comments
-
▲ 2
Two remotely exploitable Linux kernel bugs fixed in the Bluetooth stackstory by jiripospisil · 2022-11-29 · 0 comments
-
…I didn't notice that when posting, or I would have made my comment a reply to that post [1]. [0] https://github.com/google/security-research/security/advisor... [1] https://news.ycombinator.com/item?id=27842381
comment by tremon · 2021-07-15 · in CVE-2021-22555: Turning \x00\x00 into 10000$ -
To quickly identify affected and patched kernel versions see https://github.com/google/security-research/security/advisor...
comment by beermonster · 2021-07-15 · in CVE-2021-22555: Turning \x00\x00 into 10000$ -
PoC: https://github.com/google/security-research/tree/master/pocs...
comment by ndrake · 2021-04-07 · in BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution -
▲ 4
BleedingTooth: Linux Bluetooth Zero-Click Remote Code Executionstory by todsacerdoti · 2020-10-15 · 0 comments
-
…a beautiful recent example of in-band negotiation going wrong in an encryption at rest scheme. https://github.com/google/security-research/security/advisor...
comment by FiloSottile · 2020-08-24 · in Cryptography Dispatches: Registries Considered Harmful -
▲ 2
macOS is vulnerable to SpectreRSB/ret2specstory by mdriley · 2020-08-14 · 0 comments
-
…>To the best of my knowledge, Tink is the only high-level library that gets this right. [1] https://github.com/google/security-research/security/advisor... [2] https://github.com/google/tink [3] https://news.ycombinator.com/item?id=23215652
comment by cryptbe · 2020-08-10 · in Crypto Vulnerabilities in AWS S3 SDK