race-condition

2 articles in this topic.

RSS

May 2026

1 article

  1. CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp

    A TOCTOU race in VMware Fusion 25's vmx-apple binary that turns booting a VM into arbitrary chown, then arbitrary chown into a passwordless root shell via PAM injection. World-writable sticky directory, SUID-root callee, bind() and chown() both following symlinks, a 5-15 microsecond window between them. Full LPE chain in 40 seconds, single VM boot. The interesting part is what made it reliable.

    23 min read EIP Team cve-2026-41702vmware-fusionmacos
    23 min read

March 2026

1 article

  1. CVE-2026-24289: Windows Kernel IOCP Race Condition - The Ghost We Proved by Salting the Circle

    WinForge's maiden voyage: a brand new pipeline module - QEMU VMs instead of Docker, WinDbg instead of GDB, binary diffing instead of source - pointed at a use-after-free in ntoskrnl.exe. 363 functions changed between builds, 8 needles in the haystack, and a PoC that ran 500,000 iterations without crashing. Because that was the point.

    20 min read EIP Team cve-2026-24289winforgewindows-kernel
    20 min read