Remote

Anderson Nascimento

@andersonc0d3@infosec.exchange

Director and Security Researcher @alleleintel@infosec.exchange
Blog: https://blog.andersonc0d3.io

0 Followers

0 Following

29 Posts

Joined May 28, 2024

Posts

Anderson Nascimento @andersonc0d3@infosec.exchange · Aug 06, 2026

Replying to @andersonc0d3@infosec.exchange

Safe RET Interrupt Vulnerability https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7061.html

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Aug 06, 2026

Replying to @andersonc0d3@infosec.exchange

Defeating Transient Execution Attacks by Limiting Secret Reachability through REGISTER HIDING and SHADOWCFI https://people.csail.mit.edu/mengjia/data/2026.SP.RegisterHiding.pdf

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Aug 06, 2026

We can't even do a simple ret anymore. x86/bugs: Make Safe-RET robust against interrupt injection https://github.com/torvalds/linux/commit/7e7f81cf6f5ca3311e526308f55d7c54d3ba71f9

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 31, 2026

amd64: do not allow to set reserved bits in MXCSR for ptrace(PT_SETFPREGS) https://github.com/freebsd/freebsd-src/commit/cef05c5a62ba63eda222eed083972bfaa1449ac2

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 29, 2026

Initial discussion of what became the perf subsystem in the Linux kernel. [patch 0/3] [Announcement] Performance Counters for Linux https://lore.kernel.org/all/20081204225345.654705757@linutronix.de/

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 28, 2026

Release 2.47 of the GNU Binutils is now available https://inbox.sourceware.org/binutils/87o6fty5pz.fsf@redhat.com/

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 26, 2026

CoreFreq https://github.com/cyring/CoreFreq

1

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 26, 2026

RE: https://infosec.exchange/@andersonc0d3/116574727959286021 Playing with canaries Looking at SSP over several architectures. https://www.elttam.com/blog/playing-with-canaries

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

RE: https://infosec.exchange/@andersonc0d3/116980936217755939 This was fixed after I reported a way to bypass pointer guard (PTR_MANGLE) in glibc. I had known about and taught the technique in my binary exploitation classes for a few years (since ~2020/2021), but I wasn't sure whether the glibc team was aware of it. After the report, a developer mentioned several related issues and started working on the fixes. Besides the technique I reported, I didn't know about the others — I don't focus on binary exploitation beyond my training classes. I was surprised by how many issues there were in glibc that allowed mitigation bypasses. The fix for one of those issues landed in glibc 2.44 today. My report: Mitigating __pointer_chk_guard_local exposure and pointer mangling in ld.so https://sourceware.org/pipermail/libc-alpha/2026-May/177729.html

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

Replying to @gzobra@infosec.exchange

@gzobra@infosec.exchange If you're still interested, feel free to reach out to me directly and I can share the details. You can find me on other social media and DM me there.

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

Replying to @gzobra@infosec.exchange

@gzobra@infosec.exchange Yes, but I'd prefer not to name names to avoid getting involved in controversies.

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

Claude referenced an exploitation technique by the name of the researcher who wrote a public paper about it. The thing is that I had used the technique a few years before that work appeared. I didn't discover it, though. A co-worker shared it with me at the time, and he had learned it from a public work. It was there in a public work, but just a few people seem to have noticed it. That's not a problem, and today I am totally fine with it. I believe this is part of becoming mature intellectually. I've spent a great amount of time in the past reading about science and its history, and in the past I bothered when the credit went to the second and third discoverer/researcher. It has happened thousands and thousands of times. However, as I am getting older and more experienced about life, I accepted that this is uncontrollable and it's just how things work.

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

Replying to @andersonc0d3@infosec.exchange

Claude couldn't write an exploit after a few hours of work.

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

The GNU C Library version 2.44 is now available https://sourceware.org/pipermail/libc-alpha/2026-July/179159.html

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

This commit fixed a recent vulnerability in the FreeBSD kernel. procdesc: Disallow pddupfd() of non-passable files https://github.com/freebsd/freebsd-src/commit/91e11c8f2b38eb1d1f3a1d57b27378fb2c6ab3c1

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

Replying to @andersonc0d3@infosec.exchange

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

Replying to @andersonc0d3@infosec.exchange

Dennard scaling https://en.wikipedia.org/wiki/Dennard_scaling

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 25, 2026

Turing Award Winner: TPUs vs GPUs vs CPUs, Computer Architecture, RISC vs CISC | David Patterson https://www.developing.dev/p/turing-award-winner-tpu-vs-gpu-vs

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 20, 2026

Dnsmasq DNS Remote Heap Buffer Overflow https://blog.exodusintel.com/2026/07/20/dnsmasq-dns-remote-heap-buffer-overflow/

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 14, 2026

RE: https://infosec.exchange/@andersonc0d3/116903287835170560 The fixes in the quoted post are a great example of LLM-assisted development. One issue was fixed, and Sashiko automatically noticed that another component had the same issue. This has likely happened several times in Linux kernel history. I remember one case I posted about years ago — it took 301 days for the fix in the other component to land upstream. In this era of LLM-assisted development, the similar issue was spotted in just 17 seconds. "An example I often mention is the issues below. The three mechanisms (message queues, semaphores, and shared memory) of the IPC subsystem in the Linux kernel share code. Knowing this, if there's a vulnerability affecting one mechanism, it’s worth checking if it also affects the other mechanisms. They fixed a vulnerability in the semaphore mechanism but forgot the message queues and shared memory mechanisms. Analyzing public fixed vulnerabilities can help you learn about the inner details of the affected subsystem and sometimes even lead to new vulnerabilities being discovered." ipc/sem.c: fully initialize sem_array before making it visible https://github.com/torvalds/linux/commit/e8577d1f0329d4842e8302e289fb2c22156abef4 Initialize msg/shm IPC objects before doing ipc_addid() https://github.com/torvalds/linux/commit/b9a532277938798b53178d5a66af6e2915cb27cf

Quoting

Anderson Nascimento @andersonc0d3@infosec.exchange

perf/x86/amd/brs: Fix kernel address leakage https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47915e855fb38b42133e31ba917d99565f862154 perf/x86/amd/lbr: Fix kernel address leakage https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2a892294b83f541115c94b0bb637f39bef187657

Open quoted post

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 14, 2026

I used FreeBSD Boot Environment (BE) for the first time and it's awesome! It allows me to build a kernel and world (userspace), switch to them and in case of failure, revert everything back with just a command. Check out the articles below for more information about it. Managing Boot Environments https://klarasystems.com/articles/managing-boot-environments/ FreeBSD Boot Environments on ZFS https://srobb.net/fbsdbe.html ZFS Boot Environment Introduction https://wiki.freebsd.org/unitrunker/BE Boot Environments https://wiki.freebsd.org/BootEnvironments ZFS Boot Environments Revolutions https://vermaden.wordpress.com/2022/03/14/zfs-boot-environments-revolutions/

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 14, 2026

Second server that I am having issues with the fan. The first one wasn't under warranty and I didn't have support from the vendor to fix it. I ended up damaging it when trying to understand what was going on and how to fix it. This one now is new and it's already the third fan with issues. In the first two occurrences with this server, the vendor sent me new fans. I am intrigued that two different servers ended up having the same issues. The consequence of the issue is that the fans operate at higher RPMs, making a very loud noise. It shouldn't be dust. A server's fan doesn't support home-level dust?! It's also not connected to the power line directly. It's powered by a sinusoidal no-break. It's a minor problem that causes a lot of headache. The error is shown below. 2026-07-13 14:18:01 2054 FAN0001 Fan 2 RPM is less than the lower critical threshold.

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 11, 2026

perf/x86/amd/brs: Fix kernel address leakage https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=47915e855fb38b42133e31ba917d99565f862154 perf/x86/amd/lbr: Fix kernel address leakage https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2a892294b83f541115c94b0bb637f39bef187657

0

0

0

1

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 10, 2026

Debugging with CHERI CHERI is designed to improve the security of both existing and future software. https://freebsdfoundation.org/our-work/journal/browser-based-edition/improving-software-quality/debugging-with-cheri-2/

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 07, 2026

FreeBSD has added the pdopenpid() system call. It is the FreeBSD equivalent of pidfd_open() on Linux. kern: add pdopenpid(2) https://github.com/freebsd/freebsd-src/commit/5c32aa785184bb1e646b0b4c73d3c5fd9a6b8951 pdfork.2: document pdopenpid(2) https://github.com/freebsd/freebsd-src/commit/3e8b68c26e2b108dac96517ef8fd26fe7dce5bcd sys: add pdopenpid(2) https://reviews.freebsd.org/D57124

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 05, 2026

Replying to @andersonc0d3@infosec.exchange

‪Modify pages_map() to support mapping uncommitted virtual memory.‬ ‪https://github.com/jemalloc/jemalloc/commit/c2f970c32b527660a33fa513a76d913c812dcf7c‬ ‪work around heuristic overcommit causing fork failure + improve behaviour with no overcommit‬ ‪ #193‬ ‪https://github.com/jemalloc/jemalloc/issues/193‬

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jul 05, 2026

vm.overcommit_memory=2 is always the right setting for servers https://ariadne.space/2025/12/16/vmovercommitmemory-is-always-the-right.html vm.max_map_count growing steadily when vm.overcommit_memory is 2 #1328 https://github.com/jemalloc/jemalloc/issues/1328

0

1

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Jun 29, 2026

Red Hat is working on a capability for virtual machine guests (tenants) to provide their own firmware (UEFI). This is interesting for measured boot (attestation), implementing per-guest features/configurations, and various other use cases. It's known as Bring Your Own Firmware (BYOF). Introducing FUKI, guest firmware in a UKI for confidential cloud deployments (2025) https://archive.fosdem.org/2025/schedule/event/fosdem-2025-4661-introducing-fuki-guest-firmware-in-a-uki-for-confidential-cloud-deployments/ Empowering confidential VMs in the cloud to use their own firmware upon instantiation. (2024) https://people.redhat.com/~anisinha/BYOF-KVMForum2024.pdf Additionally, there is a technical challenge regarding resetting certain confidential guests. Because their CPU register states and memory regions are encrypted and inaccessible to the host, the hypervisor cannot execute a standard, hardware-assisted reset, which previously caused these confidential guests to terminate upon a reboot attempt. The author explains the problem and the two approaches to address it in the blog post below: Confidential guest reset on QEMU hypervisor: Design choices and approach https://www.redhat.com/en/blog/confidential-guest-reset-qemu-hypervisor-design-choices-and-approach

0

0

0

0

Anderson Nascimento @andersonc0d3@infosec.exchange · Feb 11, 2026

Linux kernel is adding support for a new mechanism to validate lock usage during compile-time. It depends on a new Clang feature called Thread Safety Analysis.

"Implement compiler-driven static analysis locking context checking, using the upcoming Clang 22 compiler's context analysis features."

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0923fd0419a1a2c8846e15deacac11b619e996d9

Documentation/dev-tools/context-analysis.rst
https://github.com/torvalds/linux/blob/master/Documentation/dev-tools/context-analysis.rst

Thread Safety Analysis
https://clang.llvm.org/docs/ThreadSafetyAnalysis.html

12

0

7

0

Remote instance

infosec.exchange

Open on original server

Media