PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

A deep dive into Linux’s new mseal syscall

blog.trailofbits.com | research | #linux-kernel | #v8 | #hardening | #mseal | #memory-sealing | #exploit-mitigation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A deep dive into Linux 6.10's mseal syscall, explaining how memory sealing blocks runtime tampering with VMA permissions and unmapping-based data-only exploits, inspired by Chrome's V8 CFI work.
Published
Collected

Related coverage

research · theori.io
A Deep Dive into V8 Sandbox Escape Technique Used in In-The-Wild Exploit
How Theori escaped the V8 sandbox by abusing a raw pointer in the WasmIndirectFunctionTable object to gain arbitrary write and code execution, plus patch analysis of related sandboxification commits.
research · swarm.ptsecurity.com
Creating a Ghidra processor module in SLEIGH using V8 bytecode as an example
How PT SWARM built a Ghidra processor module in SLEIGH for V8 bytecode, gaining readable disassembly and a C-like decompiler for Node.js bytecode — covering the constant pool, p-code injections, analyzers and loaders that make the module work.
research · swarm.ptsecurity.com
How we bypassed bytenode and decompiled Node.js bytecode in Ghidra
Part one of the ghidra_nodejs series: the V8 bytecode format and the bytenode scheme used to ship serialized .jsc binaries, and how the plugin parses, disassembles and decompiles them so otherwise opaque server-side JavaScript can be audited for vulnerabilities.
research · blog.quarkslab.com
Reverse Engineering the Win32k Type Isolation Mitigation
How Win32k Type Isolation (Windows 10 1709) splits the memory layout of SURFACE/Bitmap kernel objects to kill popular GDI Bitmap exploitation primitives; a deep, binary-level reconstruction.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
Back