Vulnerability research

Latest

• 

  Coordinated Disclosure: 1-Click RCE on GNOME (CVE-2023-43641)

  CVE-2023-43641 is a vulnerability in libcue, which can lead to code execution by downloading a file on GNOME.Kevin Backhouse·October 9, 2023

  Learn more
• 

  Cybersecurity spotlight on bug bounty researcher @inspector-ambitious

  For this year’s Cybersecurity Awareness Month, the GitHub bug bounty team is excited to feature another spotlight on a talented security researcher who participates in the GitHub Security Bug Bounty Program—@inspector-ambitious!Shilpa Kumari·October 2, 2023

  Learn more
• 

  Getting RCE in Chrome with incorrect side effect in the JIT compiler

  In this post, I’ll exploit CVE-2023-3420, a type confusion in Chrome that allows remote code execution (RCE) in the renderer sandbox of Chrome by a single visit to a malicious site.Man Yue Mo·September 26, 2023

  Learn more
• 

  The GitHub Security Lab’s journey to disclosing 500 CVEs in open source projects

  The GitHub Security Lab audits open source projects for security vulnerabilities and helps maintainers fix them. Recently, we passed the milestone of 500 CVEs disclosed. Let’s take a trip down memory lane with a review of some noteworthy CVEs!Xavier René-Corail·September 21, 2023

  Learn more
• 

  CodeQL team uses AI to power vulnerability detection in code

  Learn how GitHub’s CodeQL leveraged AI modeling and multi-repository variant analysis to discover a new CVE in Gradle.Walker Chabbott, Florin Coada·September 12, 2023

  Learn more
• 

  mTLS: When certificate authentication is done wrong

  In this post, we’ll deep dive into some interesting attacks on mTLS authentication. We’ll have a look at implementation vulnerabilities and how developers can make their mTLS systems vulnerable to user impersonation, privilege escalation, and information leakages.Michael Stepankin·August 17, 2023

  Learn more
• 

  Nine years of the GitHub Security Bug Bounty program

  It was another record year for our Security Bug Bounty program! We’re excited to highlight some achievements we’ve made together with the bounty community in 2022!Jill Moné-Corallo·August 14, 2023

  Learn more
• 

  Closing vulnerabilities in Decidim, a Ruby-based citizen participation platform

  This blog post describes two security vulnerabilities in Decidim, a digital platform for citizen participation. Both vulnerabilities were addressed by the Decidim team with corresponding update releases for the supported versions in May 2023.Peter Stöckli·July 28, 2023

  Learn more
• 

  Security alert: social engineering campaign targets technology industry employees

  GitHub has identified a low-volume social engineering campaign that targets the personal accounts of employees of technology firms. No GitHub or npm systems were compromised in this campaign. We’re publishing this blog post as a warning for our customers to prevent exploitation by this threat actor.Alexis Wales·July 18, 2023

  Learn more
• 

  GitHub’s revamped VIP Bug Bounty Program

  GitHub’s VIP Bug Bounty Program has been updated to include a clear and accessible criteria for receiving an invitation to the program and more. Learn more about the program and how you can become a Hacktocat, and join our community of researchers who are contributing to GitHub’s security with fun perks and access to staff and beta features!Jeff Guerra·June 12, 2023

  Learn more
• 

  Rooting with root cause: finding a variant of a Project Zero bug

  In this blog, I’ll look at CVE-2022-46395, a variant of CVE-2022-36449 (Project Zero issue 2327), and use it to gain arbitrary kernel code execution and root privileges from the untrusted app domain on an Android phone that uses the Arm Mali GPU. I’ll also explain how root cause analysis of CVE-2022-36449 led to the discovery of CVE-2022-46395.Man Yue Mo·May 25, 2023

  Learn more
• 

  Pwning Pixel 6 with a leftover patch

  In this post, I’ll look at a security-related change in version r40p0 of the Arm Mali driver that was AWOL in the January update of the Pixel bulletin, where other patches from r40p0 was applied, and how these two lines of changes can be exploited to gain arbitrary kernel code execution and root from a malicious app. This highlights how treacherous it can be when backporting security changes.Man Yue Mo·April 6, 2023

  Learn more
• 

  Multi-repository variant analysis: a powerful new way to perform security research across GitHub

  Multi-repository variant analysis lets you scale security research across thousands of repositories, giving you a powerful tool to find and respond to newly discovered vulnerabilities.Walker Chabbott, James Fletcher·March 9, 2023

  Learn more
• 

  GitHub Security Lab audited DataHub: Here’s what they found

  The GitHub Security Lab audited DataHub, an open source metadata platform, and discovered several vulnerabilities in the platform’s authentication and authorization modules. These vulnerabilities could have enabled an attacker to bypass authentication and gain access to sensitive data stored on the platform.Alvaro Munoz·March 3, 2023

  Learn more
• 

  The code that wasn’t there: Reading memory on an Android device by accident

  CVE-2022-25664, a vulnerability in the Qualcomm Adreno GPU, can be used to leak large amounts of information to a malicious Android application. Learn more about how the vulnerability can be used to leak information in both the user space and kernel space level of pages, and how the GitHub Security Lab used the kernel space information leak to construct a KASLR bypass.Man Yue Mo·February 23, 2023

  Learn more