Episode #2022-06

Dirty Pipe is a Linux kernel vulnerability that alllows overwriting data in read-only files. ¹

Orca Security discussed the AutoWrap vulnerability in Azure Automation service which allowed unauthenticated access to the authorization tokens for many customers. ²

VUSec discovered Branch History Injection, a cross-privilege Spectre-v2 attack that could leak kernel memory on modern Intel CPUs. ³

Browser-in-the-browser is a sophisicated phishing technique uncovered by @mrd0x that they create fake pop-up window with a fake address bar that most people would fall for. ⁴

Okta concluded their investigation. Microsoft also shared their findings on DEV-0537 (LAPSUS$). ⁵