CINXE.COM

<!DOCTYPE html> <html class='v2' dir='ltr' lang='en' xmlns='http://www.w3.org/1999/xhtml' xmlns:b='http://www.google.com/2005/gml/b' xmlns:data='http://www.google.com/2005/gml/data' xmlns:expr='http://www.google.com/2005/gml/expr'> <head> <link href='https://www.blogger.com/static/v1/widgets/3566091532-css_bundle_v2.css' rel='stylesheet' type='text/css'/> <meta content='width=1100' name='viewport'/> <meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/> <meta content='blogger' name='generator'/> <link href='https://googleprojectzero.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/> <link href='https://googleprojectzero.blogspot.com/2021/' rel='canonical'/> <link rel="alternate" type="application/atom+xml" title="Project Zero - Atom" href="https://googleprojectzero.blogspot.com/feeds/posts/default" /> <link rel="alternate" type="application/rss+xml" title="Project Zero - RSS" href="https://googleprojectzero.blogspot.com/feeds/posts/default?alt=rss" /> <link rel="service.post" type="application/atom+xml" title="Project Zero - Atom" href="https://www.blogger.com/feeds/4838136820032157985/posts/default" />  <meta content='https://googleprojectzero.blogspot.com/2021/' property='og:url'/> <meta content='Project Zero' property='og:title'/> <meta content='News and updates from the Project Zero team at Google' property='og:description'/> <title>Project Zero: 2021</title> <style type='text/css'>@font-face{font-family:'Open Sans';font-style:normal;font-weight:400;font-stretch:normal;font-display:swap;src:url(//fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsjZ0B4gaVY.eot);}</style> <style id='page-skin-1' type='text/css'></style> <style id='template-skin-1' type='text/css'></style> <script type='text/javascript'> (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','https://www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-240546891-1', 'auto', 'blogger'); ga('blogger.send', 'pageview'); </script> <link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4838136820032157985&zx=dd12d16f-47b1-45ec-9a52-9d6602fe5782' media='none' onload='if(media!='all')media='all'' rel='stylesheet'/><noscript><link href='https://www.blogger.com/dyn-css/authorization.css?targetBlogID=4838136820032157985&zx=dd12d16f-47b1-45ec-9a52-9d6602fe5782' rel='stylesheet'/></noscript> <meta name='google-adsense-platform-account' content='ca-host-pub-1556223355139109'/> <meta name='google-adsense-platform-domain' content='blogspot.com'/> </head> <body class='loading'> <div class='navbar section' id='navbar' name='Navbar'><div class='widget Navbar' data-version='1' id='Navbar1'><script type="text/javascript"> function setAttributeOnload(object, attribute, val) { if(window.addEventListener) { window.addEventListener('load', function(){ object[attribute] = val; }, false); } else { window.attachEvent('onload', function(){ object[attribute] = val; }); } } </script> <div id="navbar-iframe-container"></div> <script type="text/javascript" src="https://apis.google.com/js/platform.js"></script> <script type="text/javascript"> gapi.load("gapi.iframes:gapi.iframes.style.bubble", function() { if (gapi.iframes && gapi.iframes.getContext) { gapi.iframes.getContext().openChild({ url: 'https://www.blogger.com/navbar/4838136820032157985?origin\x3dhttps://googleprojectzero.blogspot.com', where: document.getElementById("navbar-iframe-container"), id: "navbar-iframe" }); } }); </script><script type="text/javascript"> (function() { var script = document.createElement('script'); script.type = 'text/javascript'; script.src = '//pagead2.googlesyndication.com/pagead/js/google_top_exp.js'; var head = document.getElementsByTagName('head')[0]; if (head) { head.appendChild(script); }})(); </script> </div></div> <div class='body-fauxcolumns'> <div class='fauxcolumn-outer body-fauxcolumn-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <div class='content'> <div class='content-fauxcolumns'> <div class='fauxcolumn-outer content-fauxcolumn-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <div class='content-outer'> <div class='content-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left content-fauxborder-left'> <div class='fauxborder-right content-fauxborder-right'></div> <div class='content-inner'> <header> <div class='header-outer'> <div class='header-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left header-fauxborder-left'> <div class='fauxborder-right header-fauxborder-right'></div> <div class='region-inner header-inner'> <div class='header section' id='header' name='Header'><div class='widget Header' data-version='1' id='Header1'> <div id='header-inner'> <div class='titlewrapper'> <h1 class='title'> <a href='https://googleprojectzero.blogspot.com/'> Project Zero </a> </h1> </div> <div class='descriptionwrapper'> News and updates from the Project Zero team at Google </div> </div> </div></div> </div> </div> <div class='header-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </header> <div class='tabs-outer'> <div class='tabs-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left tabs-fauxborder-left'> <div class='fauxborder-right tabs-fauxborder-right'></div> <div class='region-inner tabs-inner'> <div class='tabs no-items section' id='crosscol' name='Cross-Column'></div> <div class='tabs no-items section' id='crosscol-overflow' name='Cross-Column 2'></div> </div> </div> <div class='tabs-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='main-outer'> <div class='main-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left main-fauxborder-left'> <div class='fauxborder-right main-fauxborder-right'></div> <div class='region-inner main-inner'> <div class='columns fauxcolumns'> <div class='fauxcolumn-outer fauxcolumn-center-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='fauxcolumn-outer fauxcolumn-left-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <div class='fauxcolumn-outer fauxcolumn-right-outer'> <div class='cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left'> <div class='fauxborder-right'></div> <div class='fauxcolumn-inner'> </div> </div> <div class='cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div>  <div class='columns-inner'> <div class='column-center-outer'> <div class='column-center-inner'> <div class='main section' id='main' name='Main'><div class='widget Blog' data-version='1' id='Blog1'> <div class='blog-posts hfeed'> <div class="date-outer"> <h2 class='date-header'>Wednesday, December 15, 2021</h2> <div class="date-posts"> <div class='post-outer'> <div class='post hentry uncustomized-post-template' itemprop='blogPost' itemscope='itemscope' itemtype='http://schema.org/BlogPosting'> <meta content='https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvP0VlEQXC6TZWOu-zPOWC-Pnyy3uqOJpwPeP3Y_rz-ZO_MvrqjiMtMwxzIz_E8NdNyrV_Fvx-RRApoMxAPrYQcHO4eiico20He9zMm3UT5-j84CCRZDJq5hjMmeIKd0aLMsflCkfrfVHp1z1PbQmYPFX6UlVtn6_gF8P6iTQaAHL3EQ6iKs4VDdEZ/s870/image2%281%29.jpg' itemprop='image_url'/> <meta content='4838136820032157985' itemprop='blogId'/> <meta content='5073082417618502919' itemprop='postId'/> <a name='5073082417618502919'></a> <h3 class='post-title entry-title' itemprop='name'> <a href='https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html'>A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution</a> </h3> <div class='post-header'> <div class='post-header-line-1'></div> </div> <div class='post-body entry-content' id='post-body-5073082417618502919' itemprop='description articleBody'> <style type="text/css">@import url('https://themes.googleusercontent.com/fonts/css?kit=lhDjYqiy3mZ0x6ROQEUoUw');ol{margin:0;padding:0}table td,table th{padding:0}.c13{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#b7b7b7;border-top-width:1pt;border-right-width:1pt;border-left-color:#b7b7b7;vertical-align:top;border-right-color:#b7b7b7;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#b7b7b7;border-bottom-style:solid}.c0{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c5{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c20{padding-top:20pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c19{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:20pt;font-family:"Arial";font-style:normal}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:right;height:11pt}.c4{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:center}.c14{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c3{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c9{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial"}.c12{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:right}.c23{color:#000000;text-decoration:none;vertical-align:baseline;font-size:11pt;font-style:normal}.c22{border-spacing:0;border-collapse:collapse;margin-right:auto}.c21{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c16{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c17{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c2{color:inherit;text-decoration:inherit}.c15{font-weight:400;font-family:Consolas,"Courier New"}.c6{font-weight:400;font-family:"Courier New"}.c8{font-weight:700}.c11{height:0pt}.c7{font-style:italic}.c10{height:11pt}.c18{background-color:#00ff00}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}</style></head><body class="c17"> Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture (SEAR) group for collaborating with us on the technical analysis. The editorial opinions reflected below are solely Project Zero’s and do not necessarily reflect those of the organizations we collaborated with during this research. Earlier this year, Citizen Lab managed to capture an NSO iMessage-based zero-click exploit being used to target a Saudi activist. In this two-part blog post series we will describe for the first time how an in-the-wild zero-click iMessage exploit works. Based on our research and findings, we assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states. The vulnerability discussed in this blog post was fixed on September 13, 2021 in <a class="c21" href="https://support.apple.com/en-us/HT212807">iOS 14.8</a> as CVE-2021-30860. NSO <a class="c21" href="https://en.wikipedia.org/wiki/NSO_Group">NSO</a><a class="c21" href="https://en.wikipedia.org/wiki/NSO_Group"> Group</a> is one of the <a class="c21" href="https://www.atlanticcouncil.org/in-depth-research-reports/report/countering-cyber-proliferation-zeroing-in-on-access-as-a-service/">highest-profile providers of "access-as-a-service"</a>, selling packaged hacking solutions which <a class="c21" href="https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/surveillance-technology-at-the-fair/">enable nation state actors without a home-grown offensive cyber capability to "pay-to-play"</a>, vastly expanding the number of nations with such cyber capabilities. For years, groups like Citizen Lab and Amnesty International have been tracking the use of NSO's mobile spyware package "Pegasus". Despite NSO's claims that they "<a class="c21" href="https://www.nsogroup.com/governance/human-rights-policy/">[evaluate] the potential for adverse human rights impacts arising from the misuse of NSO products</a>" Pegasus has been linked to <a class="c21" href="https://citizenlab.ca/2020/01/stopping-the-press-new-york-times-journalist-targeted-by-saudi-linked-pegasus-spyware-operator/">the hacking of the New York Times journalist Ben Hubbard by the Saudi regime</a>, <a class="c21" href="https://www.amnesty.org/en/latest/research/2019/10/morocco-human-rights-defenders-targeted-with-nso-groups-spyware/">hacking of human rights defenders in Morocco</a> and <a class="c21" href="https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/">Bahrain</a>, <a class="c21" href="https://www.amnesty.org/en/latest/research/2018/08/amnesty-international-among-targets-of-nso-powered-campaign/">the targeting of Amnesty International staff</a> and dozens of other cases. Last month the United States added NSO to the "Entity List", severely restricting the ability of US companies to do business with NSO and <a class="c21" href="https://www.commerce.gov/news/press-releases/2021/11/commerce-adds-nso-group-and-other-foreign-companies-entity-list">stating in a press release</a> that "[NSO's tools] enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent." Citizen Lab was able to recover these Pegasus exploits from an iPhone and therefore this analysis covers NSO's capabilities against iPhone. We are aware that NSO sells similar zero-click capabilities which target Android devices; Project Zero does not have samples of these exploits but if you do, please reach out. From One to Zero In previous cases such as the <a class="c21" href="https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/">Million Dollar Dissident from 2016</a>, targets were sent links in SMS messages: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvP0VlEQXC6TZWOu-zPOWC-Pnyy3uqOJpwPeP3Y_rz-ZO_MvrqjiMtMwxzIz_E8NdNyrV_Fvx-RRApoMxAPrYQcHO4eiico20He9zMm3UT5-j84CCRZDJq5hjMmeIKd0aLMsflCkfrfVHp1z1PbQmYPFX6UlVtn6_gF8P6iTQaAHL3EQ6iKs4VDdEZ/s870/image2%281%29.jpg" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvP0VlEQXC6TZWOu-zPOWC-Pnyy3uqOJpwPeP3Y_rz-ZO_MvrqjiMtMwxzIz_E8NdNyrV_Fvx-RRApoMxAPrYQcHO4eiico20He9zMm3UT5-j84CCRZDJq5hjMmeIKd0aLMsflCkfrfVHp1z1PbQmYPFX6UlVtn6_gF8P6iTQaAHL3EQ6iKs4VDdEZ/s870/image2%281%29.jpg" style="max-height: 750px; max-width: 600px;" /></a> Screenshots of Phishing SMSs reported to Citizen Lab in 2016 source: <a class="c21" href="https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/">https://citizenlab.ca/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/</a> The target was only hacked when they clicked the link, a technique known as a one-click exploit. Recently, however, it has been documented that NSO is offering their clients zero-click exploitation technology, where even very technically savvy targets who might not click a phishing link are completely unaware they are being targeted. In the zero-click scenario no user interaction is required. Meaning, the attacker doesn't need to send phishing messages; the exploit just works silently in the background. Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense. One weird trick The initial entry point for Pegasus on iPhone is iMessage. This means that a victim can be targeted just using their phone number or AppleID username. iMessage has native support for GIF images, the typically small and low quality animated images popular in meme culture. You can send and receive GIFs in iMessage chats and they show up in the chat window. Apple wanted to make those GIFs loop endlessly rather than only play once, so very early on in the <a class="c21" href="https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html">iMessage parsing and processing pipeline</a> (after a message has been received but well before the message is shown), iMessage calls the following method in the IMTranscoderAgent process (outside the "BlastDoor" sandbox), passing any image file received with the extension .gif:   [IMGIFUtils copyGifFromPath:toDestinationPath:error] Looking at the selector name, the intention here was probably to just copy the GIF file before editing the loop count field, but the semantics of this method are different. Under the hood it uses the CoreGraphics APIs to render the source image to a new GIF file at the destination path. And just because the source filename has to end in .gif, that doesn't mean it's really a GIF file. The ImageIO library, <a class="c21" href="https://googleprojectzero.blogspot.com/2020/04/fuzzing-imageio.html">as detailed in a previous Project Zero blogpost</a>, is used to guess the correct format of the source file and parse it, completely ignoring the file extension. Using this "fake gif" trick, over 20 image codecs are suddenly part of the iMessage zero-click attack surface, including some very obscure and complex formats, remotely exposing probably hundreds of thousands of lines of code. Note: Apple inform us that they have restricted the available ImageIO formats reachable from IMTranscoderAgent starting in iOS 14.8.1 (26 October 2021), and completely removed the GIF code path from IMTranscoderAgent starting in iOS 15.0 (20 September 2021), with GIF decoding taking place entirely within BlastDoor. A PDF in your GIF NSO uses the "fake gif" trick to target a vulnerability in the CoreGraphics PDF parser. PDF was a popular target for exploitation around a decade ago, due to its ubiquity and complexity. Plus, the availability of javascript inside PDFs made development of reliable exploits far easier. The CoreGraphics PDF parser doesn't seem to interpret javascript, but NSO managed to find something equally powerful inside the CoreGraphics PDF parser... Extreme compression In the late 1990's, bandwidth and storage were much more scarce than they are now. It was in that environment that the <a class="c21" href="https://en.wikipedia.org/wiki/JBIG2">JBIG2</a> standard emerged. JBIG2 is a domain specific image codec designed to compress images where pixels can only be black or white. It was developed to achieve extremely high compression ratios for scans of text documents and was implemented and used in high-end office scanner/printer devices like the XEROX WorkCenter device shown below. If you used the scan to pdf functionality of a device like this a decade ago, your PDF likely had a JBIG2 stream in it.<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3gos8L_dEuVS2ltgPw-T3WxC6COMIyYoq4DlSN8Z8XgNueXzXBBlQF_BusBrKSJowwIu0OouJLMwZwPZyMiORoXCShUtbb65C3ZkKU9Tzo8ANc5862ImuSa9v1pjcjxR2v4T-UdpMYlV7DEsVgr43Mj3yAjHn_EXcxVxXFhxHqq1QXoEdP3S1JnRm/s700/image10.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj3gos8L_dEuVS2ltgPw-T3WxC6COMIyYoq4DlSN8Z8XgNueXzXBBlQF_BusBrKSJowwIu0OouJLMwZwPZyMiORoXCShUtbb65C3ZkKU9Tzo8ANc5862ImuSa9v1pjcjxR2v4T-UdpMYlV7DEsVgr43Mj3yAjHn_EXcxVxXFhxHqq1QXoEdP3S1JnRm/s700/image10.png" style="max-height: 750px; max-width: 600px;" /></a> A Xerox WorkCentre 7500 series multifunction printer, which used JBIG2 for its scan-to-pdf functionality source: <a class="c21" href="https://www.office.xerox.com/en-us/multifunction-printers/workcentre-7545-7556/specifications">https://www.office.xerox.com/en-us/multifunction-printers/workcentre-7545-7556/specifications</a> The PDFs files produced by those scanners were exceptionally small, perhaps only a few kilobytes. There are two novel techniques which JBIG2 uses to achieve these extreme compression ratios which are relevant to this exploit: Technique 1: Segmentation and substitution Effectively every text document, especially those written in languages with small alphabets like English or German, consists of many repeated letters (also known as glyphs) on each page. JBIG2 tries to segment each page into glyphs then uses simple pattern matching to match up glyphs which look the same: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2YXgDQeGK1E3GixB5S11rI1e7Xqi3cQJKuL4ZklPLYw8U1hbbEDXGOyCfcqqhoQT2evw5kHYC3Ba9RWx21XHknWvjxFKg5te5-K19ZYaoTR2wD4AmBw_c-9RXNUuonuD2TT21aTlvihuC_i_t3GgYFjw2pzL7YshGF7BZa4bq-i44V63NN6Pv7yzy/s352/image4%284%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2YXgDQeGK1E3GixB5S11rI1e7Xqi3cQJKuL4ZklPLYw8U1hbbEDXGOyCfcqqhoQT2evw5kHYC3Ba9RWx21XHknWvjxFKg5te5-K19ZYaoTR2wD4AmBw_c-9RXNUuonuD2TT21aTlvihuC_i_t3GgYFjw2pzL7YshGF7BZa4bq-i44V63NN6Pv7yzy/s352/image4%284%29.png" style="max-height: 750px; max-width: 600px;" /></a> Simple pattern matching can find all the shapes which look similar on a page, in this case all the 'e's JBIG2 doesn't actually know anything about glyphs and it isn't doing OCR (optical character recognition.) A JBIG encoder is just looking for connected regions of pixels and grouping similar looking regions together. The compression algorithm is to simply substitute all sufficiently-similar looking regions with a copy of just one of them: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2k3SPN7fikk3DnL-5YdWTK6_n1JTjvlb6qC-4tVnHeqU16cM6VWYjmMzNL9ZwMK0MXOhWITS_P0kgsx3YFHDaI2Rd5R8f1CM55ccmCBROIlyymNW2jSSCRWCpddWLuIzhGG6uB8PDKcDg5IpWW7NjdvVPZRFme3Hk4EHHmXZwEJYoohHgaVa31w0u/s327/image1%285%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2k3SPN7fikk3DnL-5YdWTK6_n1JTjvlb6qC-4tVnHeqU16cM6VWYjmMzNL9ZwMK0MXOhWITS_P0kgsx3YFHDaI2Rd5R8f1CM55ccmCBROIlyymNW2jSSCRWCpddWLuIzhGG6uB8PDKcDg5IpWW7NjdvVPZRFme3Hk4EHHmXZwEJYoohHgaVa31w0u/s327/image1%285%29.png" style="max-height: 750px; max-width: 600px;" /></a> Replacing all occurrences of similar glyphs with a copy of just one often yields a document which is still quite legible and enables very high compression ratios In this case the output is perfectly readable but the amount of information to be stored is significantly reduced. Rather than needing to store all the original pixel information for the whole page you only need a compressed version of the "reference glyph" for each character and the relative coordinates of all the places where copies should be made. The decompression algorithm then treats the output page like a canvas and "draws" the exact same glyph at all the stored locations. There's a significant issue with such a scheme: it's far too easy for a poor encoder to accidentally swap similar looking characters, and this can happen with interesting consequences. <a class="c21" href="http://www.dkriesel.com/en/blog/2013/0802_xerox-workcentres_are_switching_written_numbers_when_scanning">D. Kriesel's blog has some motivating examples</a> where PDFs of scanned invoices have different figures or PDFs of scanned construction drawings end up with incorrect measurements. These aren't the issues we're looking at, but they are one significant reason why JBIG2 is not a common compression format anymore. Technique 2: Refinement coding As mentioned above, the substitution based compression output is lossy. After a round of compression and decompression the rendered output doesn't look exactly like the input. But JBIG2 also supports lossless compression as well as an intermediate "less lossy" compression mode. It does this by also storing (and compressing) the difference between the substituted glyph and each original glyph. Here's an example showing a difference mask between a substituted character on the left and the original lossless character in the middle: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-7RiEuIp4vanQlf6nxJf1tfbuA7B61DISNjLlNxXrvSqFnqxcvSLPN6_60h2ypZdjDKHtNmCN3Nr5W66JaLw_j5iSxxntOZ0eXFB2wEQHfUjs_9LIwmckCXdTzurtKgpwyaWkGfInvM35YC3kp_K4qyJYxV4HDEf0E9W_Zqt3OelULvnfSlWAc2Kw/s267/image3%285%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh-7RiEuIp4vanQlf6nxJf1tfbuA7B61DISNjLlNxXrvSqFnqxcvSLPN6_60h2ypZdjDKHtNmCN3Nr5W66JaLw_j5iSxxntOZ0eXFB2wEQHfUjs_9LIwmckCXdTzurtKgpwyaWkGfInvM35YC3kp_K4qyJYxV4HDEf0E9W_Zqt3OelULvnfSlWAc2Kw/s267/image3%285%29.png" style="max-height: 750px; max-width: 600px;" /></a> Using the XOR operator on bitmaps to compute a difference image In this simple example the encoder can store the difference mask shown on the right, then during decompression the difference mask can be XORed with the substituted character to recover the exact pixels making up the original character. There are some more tricks outside of the scope of this blog post to further compress that difference mask using the intermediate forms of the substituted character as a "context" for the compression. Rather than completely encoding the entire difference in one go, it can be done in steps, with each iteration using a logical operator (one of AND, OR, XOR or XNOR) to set, clear or flip bits. Each successive refinement step brings the rendered output closer to the original and this allows a level of control over the "lossiness" of the compression. The implementation of these refinement coding steps is very flexible and they are also able to "read" values already present on the output canvas. A JBIG2 stream Most of the CoreGraphics PDF decoder appears to be Apple proprietary code, but the JBIG2 implementation is from Xpdf, <a class="c21" href="https://www.xpdfreader.com/download.html">the source code for which is freely available</a>. The JBIG2 format is a series of segments, which can be thought of as a series of drawing commands which are executed sequentially in a single pass. The CoreGraphics JBIG2 parser supports 19 different segment types which include operations like defining a new page, decoding a huffman table or rendering a bitmap to given coordinates on the page. Segments are represented by the class JBIG2Segment and its subclasses JBIG2Bitmap and JBIG2SymbolDict. A JBIG2Bitmap represents a rectangular array of pixels. Its data field points to a backing-buffer containing the rendering canvas. A JBIG2SymbolDict groups JBIG2Bitmaps together. The destination page is represented as a JBIG2Bitmap, as are individual glyphs. JBIG2Segments can be referred to by a segment number and the GList vector type stores pointers to all the JBIG2Segments. To look up a segment by segment number the GList is scanned sequentially. The vulnerability The vulnerability is a classic integer overflow when collating referenced segments: <a id="t.7ed94ce0bf920398965583c15daf9916cc6dcfb3"></a><a id="t.0"></a><table class="c22"><tbody><tr class="c11"><td class="c13" colspan="1" rowspan="1">   Guint numSyms; // (1)   numSyms = 0;   for (i = 0; i < nRefSegs; ++i) {     if ((seg = findSegment(refSegs[i]))) {       if (seg->getType() == jbig2SegSymbolDict) {         numSyms += ((JBIG2SymbolDict *)seg)->getSize();  // (2)       } else if (seg->getType() == jbig2SegCodeTable) {         codeTables->append(seg);       }     } else {       error(errSyntaxError, getPos(),             "Invalid segment reference in JBIG2 text region");       delete codeTables;       return;     }   } ...   // get the symbol bitmaps   syms = (JBIG2Bitmap **)gmallocn(numSyms, sizeof(JBIG2Bitmap *)); // (3)   kk = 0;   for (i = 0; i < nRefSegs; ++i) {     if ((seg = findSegment(refSegs[i]))) {       if (seg->getType() == jbig2SegSymbolDict) {         symbolDict = (JBIG2SymbolDict *)seg;         for (k = 0; k < symbolDict->getSize(); ++k) {           syms[kk++] = symbolDict->getBitmap(k); // (4)         }       }     }   }</td></tr></tbody></table> numSyms is a 32-bit integer declared at (1). By supplying carefully crafted reference segments it's possible for the repeated addition at (2) to cause numSyms to overflow to a controlled, small value. That smaller value is used for the heap allocation size at (3) meaning syms points to an undersized buffer. Inside the inner-most loop at (4) JBIG2Bitmap pointer values are written into the undersized syms buffer. Without another trick this loop would write over 32GB of data into the undersized syms buffer, certainly causing a crash. To avoid that crash the heap is groomed such that the first few writes off of the end of the syms buffer corrupt the GList backing buffer. This GList stores all known segments and is used by the findSegments routine to map from the segment numbers passed in refSegs to JBIG2Segment pointers. The overflow causes the JBIG2Segment pointers in the GList to be overwritten with JBIG2Bitmap pointers at (4). Conveniently since JBIG2Bitmap inherits from JBIG2Segment the seg->getType() virtual call succeed even on devices where Pointer Authentication is enabled (which is used to perform a weak type check on virtual calls) but the returned type will now not be equal to jbig2SegSymbolDict thus causing further writes at (4) to not be reached and bounding the extent of the memory corruption. <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9fFsg7COjTu5Aq2rV9CTyka-eczC_BvD3wrGUP3XL5W9RHoGOKElzDMbDWLrgp1BJfRvEjcw36ZdMgbA2iwnjj0jqDKGBS94UL2tdcH0evSr66V5uGUrhra3PlGyKvCznPT2rSUL3ZegDR-FXRbKw6SJFzNrgubTbAzKXKVrga6h-B3VcHFqOU9zx/s506/image6%282%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9fFsg7COjTu5Aq2rV9CTyka-eczC_BvD3wrGUP3XL5W9RHoGOKElzDMbDWLrgp1BJfRvEjcw36ZdMgbA2iwnjj0jqDKGBS94UL2tdcH0evSr66V5uGUrhra3PlGyKvCznPT2rSUL3ZegDR-FXRbKw6SJFzNrgubTbAzKXKVrga6h-B3VcHFqOU9zx/s506/image6%282%29.png" style="max-height: 750px; max-width: 600px;" /></a> A simplified view of the memory layout when the heap overflow occurs showing the undersized-buffer below the GList backing buffer and the JBIG2Bitmap Boundless unbounding Directly after the corrupted segments GList, the attacker grooms the JBIG2Bitmap object which represents the current page (the place to where current drawing commands render). JBIG2Bitmaps are simple wrappers around a backing buffer, storing the buffer’s width and height (in bits) as well as a line value which defines how many bytes are stored for each line. <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0hdaagzsqy4Esf9vjf9KS6euQUhDYTUMu9xDO8q4nxUCbVjpLmxBCJkixLWpg8YETgQNC-2DYLlPss0Eo46knC-qDRI0dLEcOHPvjbwGfaF_E_7EimexamWDy68_id27V2y9k0J2moeJg94okQoOtrMyejAg7bYepIgtdcgNH7NRz7Ne-mWeWs1QA/s1070/image7%282%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0hdaagzsqy4Esf9vjf9KS6euQUhDYTUMu9xDO8q4nxUCbVjpLmxBCJkixLWpg8YETgQNC-2DYLlPss0Eo46knC-qDRI0dLEcOHPvjbwGfaF_E_7EimexamWDy68_id27V2y9k0J2moeJg94okQoOtrMyejAg7bYepIgtdcgNH7NRz7Ne-mWeWs1QA/s1070/image7%282%29.png" style="max-height: 750px; max-width: 600px;" /></a> The memory layout of the JBIG2Bitmap object showing the segnum, w, h and line fields which are corrupted during the overflow By carefully structuring refSegs they can stop the overflow after writing exactly three more JBIG2Bitmap pointers after the end of the segments GList buffer. This overwrites the vtable pointer and the first four fields of the JBIG2Bitmap representing the current page. Due to the nature of the iOS address space layout these pointers are very likely to be in the second 4GB of virtual memory, with addresses between 0x100000000 and 0x1ffffffff. Since all iOS hardware is little endian (meaning that the w and line fields are likely to be overwritten with 0x1 — the most-significant half of a JBIG2Bitmap pointer) and the segNum and h fields are likely to be overwritten with the least-significant half of such a pointer, a fairly random value depending on heap layout and ASLR somewhere between 0x100000 and 0xffffffff. This gives the current destination page JBIG2Bitmap an unknown, but very large, value for h. Since that h value is used for bounds checking and is supposed to reflect the allocated size of the page backing buffer, this has the effect of "unbounding" the drawing canvas. This means that subsequent JBIG2 segment commands can read and write memory outside of the original bounds of the page backing buffer. The heap groom also places the current page's backing buffer just below the undersized syms buffer, such that when the page JBIG2Bitmap is unbounded, it's able to read and write its own fields: <hr style="page-break-before:always;display:none;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidgMVssjmRf7_LhtPKH-MCSJdXOZk5t6EAm-FLazQh5ssP2ksV4kIlzxSIOGz5Elrm8ROuBz92K4-Jthwu4WYa8vN61EgdpB5dbtuCULDRFhqK1TkPOE8xl63p9MAIgf1dNwYKgkYMwlgoNEFcvdDmXy6GdlcRQ5ESrN8d3bAYIEse7dGPQc3cbo8h/s550/image5%282%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEidgMVssjmRf7_LhtPKH-MCSJdXOZk5t6EAm-FLazQh5ssP2ksV4kIlzxSIOGz5Elrm8ROuBz92K4-Jthwu4WYa8vN61EgdpB5dbtuCULDRFhqK1TkPOE8xl63p9MAIgf1dNwYKgkYMwlgoNEFcvdDmXy6GdlcRQ5ESrN8d3bAYIEse7dGPQc3cbo8h/s550/image5%282%29.png" style="max-height: 750px; max-width: 600px;" /></a> The memory layout showing how the unbounded bitmap backing buffer is able to reference the JBIG2Bitmap object and modify fields in it as it is located after the backing buffer in memory By rendering 4-byte bitmaps at the correct canvas coordinates they can write to all the fields of the page JBIG2Bitmap and by carefully choosing new values for w, h and line, they can write to arbitrary offsets from the page backing buffer. At this point it would also be possible to write to arbitrary absolute memory addresses if you knew their offsets from the page backing buffer. But how to compute those offsets? Thus far, this exploit has proceeded in a manner very similar to a "canonical" scripting language exploit which in Javascript might end up with an unbounded ArrayBuffer object with access to memory. But in those cases the attacker has the ability to run arbitrary Javascript which can obviously be used to compute offsets and perform arbitrary computations. How do you do that in a single-pass image parser? My other compression format is turing-complete! As mentioned earlier, the sequence of steps which implement JBIG2 refinement are very flexible. Refinement steps can reference both the output bitmap and any previously created segments, as well as render output to either the current page or a segment. By carefully crafting the context-dependent part of the refinement decompression, it's possible to craft sequences of segments where only the refinement combination operators have any effect. In practice this means it is possible to apply the AND, OR, XOR and XNOR logical operators between memory regions at arbitrary offsets from the current page's JBIG2Bitmap backing buffer. And since that has been unbounded… it's possible to perform those logical operations on memory at arbitrary out-of-bounds offsets: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjFkcS4JjzhV7pzJ5kVEmFj7WLW5Zzdc0JkYDaQBhVYIDayiYOksOID0LFOFGr9qQA44qwe3LRN9KNqOelKIflmcTDnR3k6qrtfvJ4wsoTDyuM59nmE6DGM_n_wOUMNY8HoLybtywIMq2-VdeFVwHHc9aDe0tkExa4hfvXKJ6o_m2QYT2LXp4NGDNJI/s551/image9%281%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjFkcS4JjzhV7pzJ5kVEmFj7WLW5Zzdc0JkYDaQBhVYIDayiYOksOID0LFOFGr9qQA44qwe3LRN9KNqOelKIflmcTDnR3k6qrtfvJ4wsoTDyuM59nmE6DGM_n_wOUMNY8HoLybtywIMq2-VdeFVwHHc9aDe0tkExa4hfvXKJ6o_m2QYT2LXp4NGDNJI/s551/image9%281%29.png" style="max-height: 750px; max-width: 600px;" /></a> The memory layout showing how logical operators can be applied out-of-bounds It's when you take this to its most extreme form that things start to get really interesting. What if rather than operating on glyph-sized sub-rectangles you instead operated on single bits? You can now provide as input a sequence of JBIG2 segment commands which implement a sequence of logical bit operations to apply to the page. And since the page buffer has been unbounded those bit operations can operate on arbitrary memory. With a bit of back-of-the-envelope scribbling you can convince yourself that with just the available AND, OR, XOR and XNOR logical operators you can in fact compute any computable function - the simplest proof being that you can create a logical NOT operator by XORing with 1 and then putting an AND gate in front of that to form a NAND gate: <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBpKF2iKJhndHIFtGm9xUBVjpXOM4GYcwSdNyfuUvwI-883zmbnhi_Ch6CR4XEaA6D2uaGkU3g8rNocZS_ZlWXD8rTSRGTgYact6ar43k8ywMZG6hnjDz8Yr3pC3Fh4W3dggIA_XriPw1Vc6myG-18TPe8Ffj_NGuywLqz4tpdlrbMAso-CBZcM_4X/s265/image8%282%29.png" style="display: block; padding: 1em 0;text-align: center;"><img alt="" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjBpKF2iKJhndHIFtGm9xUBVjpXOM4GYcwSdNyfuUvwI-883zmbnhi_Ch6CR4XEaA6D2uaGkU3g8rNocZS_ZlWXD8rTSRGTgYact6ar43k8ywMZG6hnjDz8Yr3pC3Fh4W3dggIA_XriPw1Vc6myG-18TPe8Ffj_NGuywLqz4tpdlrbMAso-CBZcM_4X/s265/image8%282%29.png" style="max-height: 750px; max-width: 600px;" /></a> An AND gate connected to one input of an XOR gate. The other XOR gate input is connected to the constant value 1 creating an NAND. A NAND gate is an example of a universal logic gate; one from which all other gates can be built and from which a circuit can be <a class="c21" href="https://www.nand2tetris.org/">built to compute any computable function</a>. Practical circuits JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent. The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying. In a future post (currently being finished), we'll take a look at exactly how they escape the IMTranscoderAgent sandbox. <div style='clear: both;'></div> </div> <div class='post-footer'> <div class='post-footer-line post-footer-line-1'> Posted by Anonymous at <meta content='https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html' itemprop='url'/> <a class='timestamp-link' href='https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html' rel='bookmark' title='permanent link'><abbr class='published' itemprop='datePublished' title='2021-12-15T09:00:00-08:00'>9:00 AM</abbr></a> <a class='comment-link' href='https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html#comment-form' onclick=''> No comments: </a> <a href='https://www.blogger.com/post-edit.g?blogID=4838136820032157985&postID=5073082417618502919&from=pencil' title='Edit Post'> <img alt='' class='icon-action' height='18' src='https://resources.blogblog.com/img/icon18_edit_allbkg.gif' width='18'/> </a> <div class='post-share-buttons goog-inline-block'> <a class='goog-inline-block share-button sb-email' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=5073082417618502919&target=email' target='_blank' title='Email This'>Email This</a><a class='goog-inline-block share-button sb-blog' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=5073082417618502919&target=blog' onclick='window.open(this.href, "_blank", "height=270,width=475"); return false;' target='_blank' title='BlogThis!'>BlogThis!</a><a class='goog-inline-block share-button sb-twitter' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=5073082417618502919&target=twitter' target='_blank' title='Share to X'>Share to X</a><a class='goog-inline-block share-button sb-facebook' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=5073082417618502919&target=facebook' onclick='window.open(this.href, "_blank", "height=430,width=640"); return false;' target='_blank' title='Share to Facebook'>Share to Facebook</a><a class='goog-inline-block share-button sb-pinterest' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=5073082417618502919&target=pinterest' target='_blank' title='Share to Pinterest'>Share to Pinterest</a> </div> </div> <div class='post-footer-line post-footer-line-2'> </div> <div class='post-footer-line post-footer-line-3'> </div> </div> </div> </div> </div></div> <div class="date-outer"> <h2 class='date-header'>Wednesday, December 1, 2021</h2> <div class="date-posts"> <div class='post-outer'> <div class='post hentry uncustomized-post-template' itemprop='blogPost' itemscope='itemscope' itemtype='http://schema.org/BlogPosting'> <meta content='4838136820032157985' itemprop='blogId'/> <meta content='7868790017880077590' itemprop='postId'/> <a name='7868790017880077590'></a> <h3 class='post-title entry-title' itemprop='name'> <a href='https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html'>This shouldn't have happened: A vulnerability postmortem</a> </h3> <div class='post-header'> <div class='post-header-line-1'></div> </div> <div class='post-body entry-content' id='post-body-7868790017880077590' itemprop='description articleBody'> <style type="text/css">@import url('https://themes.googleusercontent.com/fonts/css?kit=t66UaDGGO9uRFa9A_n0Ge4kPz49mG1-u2NJpkhDAP5E');.lst-kix_q4elz23jmthh-5>li{counter-increment:lst-ctn-kix_q4elz23jmthh-5}ol.lst-kix_q4elz23jmthh-6.start{counter-reset:lst-ctn-kix_q4elz23jmthh-6 0}ul.lst-kix_wy7koemfbmv1-3{list-style-type:none}ul.lst-kix_wy7koemfbmv1-2{list-style-type:none}ul.lst-kix_wy7koemfbmv1-5{list-style-type:none}.lst-kix_2hgb22nra90i-8>li:before{content:"\0025a0 "}ul.lst-kix_wy7koemfbmv1-4{list-style-type:none}ul.lst-kix_wy7koemfbmv1-1{list-style-type:none}.lst-kix_2hgb22nra90i-7>li:before{content:"\0025cb "}ul.lst-kix_wy7koemfbmv1-0{list-style-type:none}ol.lst-kix_q4elz23jmthh-0.start{counter-reset:lst-ctn-kix_q4elz23jmthh-0 0}.lst-kix_2hgb22nra90i-4>li:before{content:"\0025cb "}.lst-kix_2hgb22nra90i-6>li:before{content:"\0025cf "}.lst-kix_2hgb22nra90i-5>li:before{content:"\0025a0 "}ul.lst-kix_z8xtsan2wa5s-5{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-6{list-style-type:none}.lst-kix_q4elz23jmthh-7>li{counter-increment:lst-ctn-kix_q4elz23jmthh-7}ul.lst-kix_z8xtsan2wa5s-7{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-8{list-style-type:none}.lst-kix_2hgb22nra90i-0>li:before{content:"\0025cf "}.lst-kix_2hgb22nra90i-2>li:before{content:"\0025a0 "}.lst-kix_2hgb22nra90i-3>li:before{content:"\0025cf "}ul.lst-kix_z8xtsan2wa5s-0{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-1{list-style-type:none}ul.lst-kix_wy7koemfbmv1-7{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-2{list-style-type:none}ul.lst-kix_wy7koemfbmv1-6{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-3{list-style-type:none}ul.lst-kix_z8xtsan2wa5s-4{list-style-type:none}.lst-kix_2hgb22nra90i-1>li:before{content:"\0025cb "}ul.lst-kix_wy7koemfbmv1-8{list-style-type:none}.lst-kix_q4elz23jmthh-5>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-5,lower-roman) ". "}.lst-kix_q4elz23jmthh-6>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-6,decimal) ". "}.lst-kix_q4elz23jmthh-4>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-4,lower-latin) ". "}.lst-kix_q4elz23jmthh-8>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-8,lower-roman) ". "}.lst-kix_oetzaqvyxxoa-0>li:before{content:"\0025cf "}.lst-kix_oetzaqvyxxoa-1>li:before{content:"\0025cb "}.lst-kix_oetzaqvyxxoa-2>li:before{content:"\0025a0 "}.lst-kix_oetzaqvyxxoa-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-7>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-7,lower-latin) ". "}.lst-kix_q4elz23jmthh-0>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-0,decimal) ". "}.lst-kix_q4elz23jmthh-1>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-1,lower-latin) ". "}.lst-kix_q4elz23jmthh-2>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-2,lower-roman) ". "}.lst-kix_q4elz23jmthh-3>li{counter-increment:lst-ctn-kix_q4elz23jmthh-3}.lst-kix_q4elz23jmthh-3>li:before{content:"" counter(lst-ctn-kix_q4elz23jmthh-3,decimal) ". "}ul.lst-kix_ohd9cwgi2ci1-5{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-4{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-7{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-6{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-8{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-2{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-3{list-style-type:none}.lst-kix_oetzaqvyxxoa-6>li:before{content:"\0025cf "}.lst-kix_oetzaqvyxxoa-7>li:before{content:"\0025cb "}ul.lst-kix_ugjdqlaeq7aq-0{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-1{list-style-type:none}ol.lst-kix_q4elz23jmthh-5.start{counter-reset:lst-ctn-kix_q4elz23jmthh-5 0}ul.lst-kix_ugjdqlaeq7aq-6{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-7{list-style-type:none}.lst-kix_oetzaqvyxxoa-4>li:before{content:"\0025cb "}.lst-kix_oetzaqvyxxoa-5>li:before{content:"\0025a0 "}.lst-kix_oetzaqvyxxoa-8>li:before{content:"\0025a0 "}ul.lst-kix_ugjdqlaeq7aq-4{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-5{list-style-type:none}ul.lst-kix_ugjdqlaeq7aq-8{list-style-type:none}.lst-kix_x7i5vtjupm2f-2>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-6>li:before{content:"\0025cf "}ul.lst-kix_2fd9br43vo52-4{list-style-type:none}ul.lst-kix_2fd9br43vo52-3{list-style-type:none}.lst-kix_ohd9cwgi2ci1-3>li:before{content:"\0025cf "}ul.lst-kix_2fd9br43vo52-6{list-style-type:none}ul.lst-kix_2fd9br43vo52-5{list-style-type:none}ul.lst-kix_2fd9br43vo52-8{list-style-type:none}.lst-kix_fvn7czyjg1wz-2>li:before{content:"\0025a0 "}ul.lst-kix_2fd9br43vo52-7{list-style-type:none}.lst-kix_x7i5vtjupm2f-4>li:before{content:"\0025cb "}.lst-kix_2fd9br43vo52-3>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-4>li:before{content:"\0025cb "}ul.lst-kix_2fd9br43vo52-0{list-style-type:none}.lst-kix_2fd9br43vo52-5>li:before{content:"\0025a0 "}ul.lst-kix_2fd9br43vo52-2{list-style-type:none}ul.lst-kix_2fd9br43vo52-1{list-style-type:none}.lst-kix_4idwybng3hbx-2>li:before{content:"\0025a0 "}.lst-kix_2fd9br43vo52-7>li:before{content:"\0025cb "}.lst-kix_fvn7czyjg1wz-8>li:before{content:"\0025a0 "}.lst-kix_ohd9cwgi2ci1-1>li:before{content:"\0025cb "}.lst-kix_4idwybng3hbx-0>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-6>li:before{content:"\0025cf "}.lst-kix_x7i5vtjupm2f-0>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-8>li:before{content:"\0025a0 "}ul.lst-kix_fvn7czyjg1wz-2{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-1{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-0{list-style-type:none}.lst-kix_wy7koemfbmv1-4>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-6>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-7.start{counter-reset:lst-ctn-kix_q4elz23jmthh-7 0}.lst-kix_wy7koemfbmv1-0>li:before{content:"\0025cf "}.lst-kix_wy7koemfbmv1-2>li:before{content:"\0025a0 "}.lst-kix_ugjdqlaeq7aq-0>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-5>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-7>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-1>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-2>li:before{content:"\0025a0 "}ul.lst-kix_2hgb22nra90i-0{list-style-type:none}ul.lst-kix_2hgb22nra90i-1{list-style-type:none}ul.lst-kix_2hgb22nra90i-2{list-style-type:none}ul.lst-kix_2hgb22nra90i-3{list-style-type:none}.lst-kix_fvn7czyjg1wz-0>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-4>li:before{content:"\0025cb "}ul.lst-kix_2hgb22nra90i-4{list-style-type:none}ul.lst-kix_2hgb22nra90i-5{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-8{list-style-type:none}ul.lst-kix_2hgb22nra90i-6{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-7{list-style-type:none}ul.lst-kix_2hgb22nra90i-7{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-6{list-style-type:none}ul.lst-kix_2hgb22nra90i-8{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-5{list-style-type:none}ul.lst-kix_fvn7czyjg1wz-4{list-style-type:none}.lst-kix_x7i5vtjupm2f-8>li:before{content:"\0025a0 "}ul.lst-kix_fvn7czyjg1wz-3{list-style-type:none}ul.lst-kix_81cegzboe9ky-8{list-style-type:none}ul.lst-kix_81cegzboe9ky-5{list-style-type:none}ul.lst-kix_81cegzboe9ky-4{list-style-type:none}ul.lst-kix_81cegzboe9ky-7{list-style-type:none}ul.lst-kix_81cegzboe9ky-6{list-style-type:none}ol.lst-kix_q4elz23jmthh-8.start{counter-reset:lst-ctn-kix_q4elz23jmthh-8 0}ul.lst-kix_oetzaqvyxxoa-2{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-3{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-0{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-1{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-6{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-7{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-4{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-5{list-style-type:none}ul.lst-kix_oetzaqvyxxoa-8{list-style-type:none}ul.lst-kix_4idwybng3hbx-5{list-style-type:none}ul.lst-kix_4idwybng3hbx-4{list-style-type:none}.lst-kix_81cegzboe9ky-2>li:before{content:"\0025a0 "}.lst-kix_81cegzboe9ky-4>li:before{content:"\0025cb "}ul.lst-kix_4idwybng3hbx-7{list-style-type:none}ul.lst-kix_4idwybng3hbx-6{list-style-type:none}.lst-kix_wy7koemfbmv1-6>li:before{content:"\0025cf "}ul.lst-kix_4idwybng3hbx-8{list-style-type:none}.lst-kix_2gk0zovl15u8-4>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-0>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-6>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-8>li:before{content:"\0025a0 "}.lst-kix_wy7koemfbmv1-8>li:before{content:"\0025a0 "}ul.lst-kix_4idwybng3hbx-1{list-style-type:none}ul.lst-kix_4idwybng3hbx-0{list-style-type:none}ul.lst-kix_4idwybng3hbx-3{list-style-type:none}.lst-kix_2gk0zovl15u8-6>li:before{content:"\0025cf "}ul.lst-kix_4idwybng3hbx-2{list-style-type:none}.lst-kix_prwgb47nvxz6-8>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-8>li:before{content:"\0025a0 "}ul.lst-kix_81cegzboe9ky-1{list-style-type:none}ul.lst-kix_81cegzboe9ky-0{list-style-type:none}ul.lst-kix_81cegzboe9ky-3{list-style-type:none}ul.lst-kix_81cegzboe9ky-2{list-style-type:none}.lst-kix_z8xtsan2wa5s-3>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-2>li:before{content:"\0025a0 "}.lst-kix_z8xtsan2wa5s-4>li:before{content:"\0025cb "}.lst-kix_prwgb47nvxz6-0>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-1>li:before{content:"\0025cb "}.lst-kix_z8xtsan2wa5s-5>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-1>li:before{content:"\0025cb "}ol.lst-kix_q4elz23jmthh-4{list-style-type:none}ol.lst-kix_q4elz23jmthh-3{list-style-type:none}ol.lst-kix_q4elz23jmthh-3.start{counter-reset:lst-ctn-kix_q4elz23jmthh-3 0}ol.lst-kix_q4elz23jmthh-6{list-style-type:none}ol.lst-kix_q4elz23jmthh-5{list-style-type:none}ol.lst-kix_q4elz23jmthh-0{list-style-type:none}ol.lst-kix_q4elz23jmthh-2{list-style-type:none}ol.lst-kix_q4elz23jmthh-1{list-style-type:none}.lst-kix_prwgb47nvxz6-6>li:before{content:"\0025cf "}.lst-kix_prwgb47nvxz6-5>li:before{content:"\0025a0 "}.lst-kix_z8xtsan2wa5s-7>li:before{content:"\0025cb "}.lst-kix_prwgb47nvxz6-3>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-6>li:before{content:"\0025cf "}.lst-kix_z8xtsan2wa5s-8>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-2>li:before{content:"\0025a0 "}.lst-kix_prwgb47nvxz6-4>li:before{content:"\0025cb "}.lst-kix_2gk0zovl15u8-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-6>li{counter-increment:lst-ctn-kix_q4elz23jmthh-6}.lst-kix_2gk0zovl15u8-2>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-1>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-8>li:before{content:"\0025a0 "}.lst-kix_2gk0zovl15u8-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-6>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-7>li:before{content:"\0025cb "}.lst-kix_q4elz23jmthh-4>li{counter-increment:lst-ctn-kix_q4elz23jmthh-4}ol.lst-kix_q4elz23jmthh-8{list-style-type:none}ol.lst-kix_q4elz23jmthh-7{list-style-type:none}.lst-kix_z8xtsan2wa5s-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-0>li:before{content:"\0025cf "}.lst-kix_cw1yal3teuur-2>li:before{content:"\0025a0 "}.lst-kix_cw1yal3teuur-3>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-4.start{counter-reset:lst-ctn-kix_q4elz23jmthh-4 0}.lst-kix_cw1yal3teuur-1>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-4>li:before{content:"\0025cb "}.lst-kix_cw1yal3teuur-5>li:before{content:"\0025a0 "}.lst-kix_4idwybng3hbx-6>li:before{content:"\0025cf "}.lst-kix_4idwybng3hbx-5>li:before{content:"\0025a0 "}.lst-kix_4idwybng3hbx-7>li:before{content:"\0025cb "}.lst-kix_q4elz23jmthh-0>li{counter-increment:lst-ctn-kix_q4elz23jmthh-0}.lst-kix_4idwybng3hbx-3>li:before{content:"\0025cf "}.lst-kix_4idwybng3hbx-4>li:before{content:"\0025cb "}.lst-kix_4idwybng3hbx-8>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-5>li:before{content:"\0025a0 "}.lst-kix_x7i5vtjupm2f-7>li:before{content:"\0025cb "}.lst-kix_x7i5vtjupm2f-3>li:before{content:"\0025cf "}.lst-kix_ohd9cwgi2ci1-4>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-2>li:before{content:"\0025a0 "}.lst-kix_fvn7czyjg1wz-3>li:before{content:"\0025cf "}ul.lst-kix_x7i5vtjupm2f-8{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-1{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-4{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-0{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-5{list-style-type:none}ul.lst-kix_ohd9cwgi2ci1-3{list-style-type:none}.lst-kix_2fd9br43vo52-4>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-6{list-style-type:none}.lst-kix_fvn7czyjg1wz-5>li:before{content:"\0025a0 "}ul.lst-kix_ohd9cwgi2ci1-2{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-7{list-style-type:none}.lst-kix_ohd9cwgi2ci1-2>li:before{content:"\0025a0 "}ul.lst-kix_x7i5vtjupm2f-0{list-style-type:none}ul.lst-kix_x7i5vtjupm2f-1{list-style-type:none}ul.lst-kix_prwgb47nvxz6-8{list-style-type:none}.lst-kix_4idwybng3hbx-1>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-2{list-style-type:none}.lst-kix_x7i5vtjupm2f-1>li:before{content:"\0025cb "}ul.lst-kix_x7i5vtjupm2f-3{list-style-type:none}.lst-kix_ohd9cwgi2ci1-0>li:before{content:"\0025cf "}.lst-kix_2fd9br43vo52-6>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-7>li:before{content:"\0025cb "}.lst-kix_wy7koemfbmv1-5>li:before{content:"\0025a0 "}ul.lst-kix_prwgb47nvxz6-2{list-style-type:none}ul.lst-kix_prwgb47nvxz6-3{list-style-type:none}ul.lst-kix_prwgb47nvxz6-0{list-style-type:none}ul.lst-kix_prwgb47nvxz6-1{list-style-type:none}ul.lst-kix_prwgb47nvxz6-6{list-style-type:none}ul.lst-kix_prwgb47nvxz6-7{list-style-type:none}ul.lst-kix_prwgb47nvxz6-4{list-style-type:none}ul.lst-kix_prwgb47nvxz6-5{list-style-type:none}.lst-kix_wy7koemfbmv1-3>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-7>li:before{content:"\0025cb "}.lst-kix_wy7koemfbmv1-1>li:before{content:"\0025cb "}.lst-kix_ohd9cwgi2ci1-6>li:before{content:"\0025cf "}.lst-kix_ugjdqlaeq7aq-1>li:before{content:"\0025cb "}.lst-kix_2fd9br43vo52-0>li:before{content:"\0025cf "}.lst-kix_fvn7czyjg1wz-1>li:before{content:"\0025cb "}.lst-kix_ugjdqlaeq7aq-5>li:before{content:"\0025a0 "}.lst-kix_ugjdqlaeq7aq-3>li:before{content:"\0025cf "}.lst-kix_q4elz23jmthh-1>li{counter-increment:lst-ctn-kix_q4elz23jmthh-1}.lst-kix_ohd9cwgi2ci1-8>li:before{content:"\0025cf "}ol.lst-kix_q4elz23jmthh-1.start{counter-reset:lst-ctn-kix_q4elz23jmthh-1 0}.lst-kix_q4elz23jmthh-8>li{counter-increment:lst-ctn-kix_q4elz23jmthh-8}.lst-kix_q4elz23jmthh-2>li{counter-increment:lst-ctn-kix_q4elz23jmthh-2}.lst-kix_81cegzboe9ky-3>li:before{content:"\0025cf "}.lst-kix_81cegzboe9ky-1>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-5>li:before{content:"\0025a0 "}.lst-kix_2fd9br43vo52-8>li:before{content:"\0025a0 "}.lst-kix_wy7koemfbmv1-7>li:before{content:"\0025cb "}.lst-kix_81cegzboe9ky-7>li:before{content:"\0025cb "}.lst-kix_2gk0zovl15u8-5>li:before{content:"\0025a0 "}ul.lst-kix_2gk0zovl15u8-0{list-style-type:none}ul.lst-kix_2gk0zovl15u8-2{list-style-type:none}.lst-kix_2gk0zovl15u8-7>li:before{content:"\0025cb "}ul.lst-kix_2gk0zovl15u8-1{list-style-type:none}li.li-bullet-0:before{margin-left:-18pt;white-space:nowrap;display:inline-block;min-width:18pt}ul.lst-kix_2gk0zovl15u8-4{list-style-type:none}ul.lst-kix_2gk0zovl15u8-3{list-style-type:none}ul.lst-kix_cw1yal3teuur-5{list-style-type:none}.lst-kix_prwgb47nvxz6-7>li:before{content:"\0025cb "}ul.lst-kix_2gk0zovl15u8-6{list-style-type:none}ul.lst-kix_cw1yal3teuur-4{list-style-type:none}ul.lst-kix_2gk0zovl15u8-5{list-style-type:none}ul.lst-kix_cw1yal3teuur-7{list-style-type:none}ul.lst-kix_2gk0zovl15u8-8{list-style-type:none}ul.lst-kix_cw1yal3teuur-6{list-style-type:none}ul.lst-kix_2gk0zovl15u8-7{list-style-type:none}ul.lst-kix_cw1yal3teuur-8{list-style-type:none}ul.lst-kix_cw1yal3teuur-1{list-style-type:none}ol.lst-kix_q4elz23jmthh-2.start{counter-reset:lst-ctn-kix_q4elz23jmthh-2 0}ul.lst-kix_cw1yal3teuur-0{list-style-type:none}ul.lst-kix_cw1yal3teuur-3{list-style-type:none}ul.lst-kix_cw1yal3teuur-2{list-style-type:none}ol{margin:0;padding:0}table td,table th{padding:0}.c15{border-right-style:solid;padding:5pt 5pt 5pt 5pt;border-bottom-color:#000000;border-top-width:1pt;border-right-width:1pt;border-left-color:#000000;vertical-align:top;border-right-color:#000000;border-left-width:1pt;border-top-style:solid;border-left-style:solid;border-bottom-width:1pt;width:468pt;border-top-color:#000000;border-bottom-style:solid}.c6{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:italic}.c2{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c31{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.3;text-align:left;height:11pt}.c13{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c19{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#009900;font-weight:400}.c34{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.3;text-align:left}.c12{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#993333;font-weight:400}.c1{background-color:#ffffff;font-size:8pt;font-family:Consolas,"Courier New";color:#212529;font-weight:400}.c45{color:#333333;text-decoration:none;vertical-align:baseline;font-size:30pt;font-family:"Amatic SC"}.c7{font-size:8pt;font-family:Consolas,"Courier New";color:#333333;font-weight:400}.c4{margin-left:36pt;border-spacing:0;border-collapse:collapse;margin-right:auto}.c14{border-spacing:0;border-collapse:collapse;margin-right:auto}.c26{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c11{color:#000000;font-weight:400;font-size:11pt;font-family:"Arial"}.c3{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c10{font-size:8pt;font-family:Consolas,"Courier New";color:#0000ff;font-weight:400}.c40{padding-top:0pt;padding-bottom:0pt;line-height:1.5;text-align:center}.c24{color:#000000;font-weight:700;font-size:11pt;font-family:"Arial"}.c0{font-size:9pt;font-family:Consolas,"Courier New";color:#333333;font-weight:400}.c18{font-size:8pt;font-family:Consolas,"Courier New";color:#008080;font-weight:400}.c5{font-size:9pt;font-family:Consolas,"Courier New";color:#0000ff;font-weight:400}.c30{color:#000000;font-weight:400;font-size:10pt;font-family:"Arial"}.c42{background-color:#ffffff;font-size:8pt;color:#b1b100}.c47{font-weight:400;font-size:8pt;font-family:"Arial"}.c28{background-color:#ffffff;font-size:8pt;color:#000066}.c38{background-color:#ffffff;font-size:8pt;color:#ff0000}.c23{background-color:#ffffff;font-size:8pt;color:#339933}.c8{text-decoration:none;vertical-align:baseline;font-style:normal}.c50{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c46{text-decoration:none;vertical-align:baseline;font-style:italic}.c51{background-color:#ffffff;font-size:8pt;color:#0000dd}.c9{color:inherit;text-decoration:inherit}.c27{margin-left:36pt;padding-left:0pt}.c17{padding:0;margin:0}.c22{font-size:9pt;color:#008000}.c21{font-weight:400;font-family:Consolas,"Courier New"}.c33{orphans:2;widows:2}.c44{width:33%;height:1px}.c35{font-weight:400;font-style:italic}.c48{font-size:8pt;color:#8b0000}.c29{height:0pt}.c39{font-size:11pt}.c32{font-weight:700}.c41{font-size:10pt}.c20{vertical-align:super}.c49{height:11pt}.c36{color:#000000}.c16{page-break-after:avoid}.c37{font-size:5pt}.c43{margin-left:36pt}.c25{font-size:9pt}.title{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#000000;font-size:10pt;padding-bottom:0pt;font-family:"Arial";line-height:1.0;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:0pt;color:#000000;font-weight:700;font-size:11pt;padding-bottom:0pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}</style></head><body class="c50"><div> Posted by Tavis Ormandy, Project Zero <h1 class="c13 c16" id="h.ce7bhufj5ofg">Introduction</h1> This is an unusual blog post. I normally write posts to highlight some hidden attack surface or interesting complex vulnerability class. This time, I want to talk about a vulnerability that is neither of those things. The striking thing about this vulnerability is just how simple it is. This should have been caught earlier, and I want to explore why that didn’t happen. In 2021, all good bugs need a catchy name, so I’m calling this one “BigSig”. First, let’s take a look at the bug, I’ll explain how I found it and then try to understand why we missed it for so long. <h1 class="c13 c16" id="h.7ttrpxxbs2f9">Analysis</h1> <a class="c91" href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Overview">Network Security Services</a> (NSS) is Mozilla's widely used, cross-platform cryptography library. When you verify an ASN.1 encoded digital signature, NSS will create a <a class="c91" href="https://searchfox.org/mozilla-central/rev/f8576fec48d866c5f988baaf1fa8d2f8cce2a82f/security/nss/lib/cryptohi/secvfy.c#120">VFYContext</a> structure to store the necessary data. This includes things like the public key, the hash algorithm, and the signature itself. <a id="t.9a4d5980e1b13f527ae3eec9673b5d4e7a7010ba"></a><a id="t.0"></a><table class="c14"><tbody><tr class="c29"><td class="c15" colspan="1" rowspan="1"> struct VFYContextStr {    SECOidTag hashAlg; /* the hash algorithm */    SECKEYPublicKey *key;    union {        unsigned char buffer[1];        unsigned char dsasig[DSA_MAX_SIGNATURE_LEN];        unsigned char ecdsasig[2 * MAX_ECKEY_LEN];        unsigned char rsasig[(RSA_MAX_MODULUS_BITS + 7) / 8];    } u;    unsigned int pkcs1RSADigestInfoLen;    unsigned char *pkcs1RSADigestInfo;    void *wincx;    void *hashcx;    const SECHashObject *hashobj;    SECOidTag encAlg;    /* enc alg */    PRBool hasSignature;    SECItem *params; };</td></tr><tr class="c29"><td class="c15" colspan="1" rowspan="1"> Fig 1. The VFYContext structure from NSS.</td></tr></tbody></table> The maximum size signature that this structure can handle is whatever the largest union member is, in this case that’s RSA at <a class="c91" href="https://searchfox.org/mozilla-central/rev/f8576fec48d866c5f988baaf1fa8d2f8cce2a82f/security/nss/lib/freebl/blapit.h#139">2048 bytes</a>. That’s 16384 bits, large enough to accommodate signatures from even the most ridiculously oversized keys. Okay, but what happens if you just....make a signature that’s bigger than that? Well, it turns out the answer is memory corruption. Yes, really. The untrusted signature is simply copied into this fixed-sized buffer, overwriting adjacent members with arbitrary attacker-controlled data. The bug is simple to reproduce and affects multiple algorithms. The easiest to demonstrate is RSA-PSS. In fact, just these three commands work: <a id="t.488dd1b55b75f3df66e36d7bc8b67538aa8c4fd3"></a><a id="t.1"></a><table class="c14"><tbody><tr class="c29"><td class="c15" colspan="1" rowspan="1"> # We need 16384 bits to fill the buffer, then 32 + 64 + 64 + 64 bits to overflow to hashobj, # which contains function pointers (bigger would work too, but takes longer to generate). $ openssl genpkey -algorithm rsa-pss -pkeyopt rsa_keygen_bits:$((16384 + 32 + 64 + 64 + 64)) -pkeyopt rsa_keygen_primes:5 -out bigsig.key # Generate a self-signed certificate from that key $ openssl req -x509 -new -key bigsig.key -subj "/CN=BigSig" -sha256 -out bigsig.cer # Verify it with NSS... $ vfychain -a bigsig.cer Segmentation fault</td></tr><tr class="c29"><td class="c15" colspan="1" rowspan="1"> Fig 2. Reproducing the BigSig vulnerability in three easy commands.</td></tr></tbody></table> The actual code that does the corruption varies based on the algorithm; <a class="c91" href="https://searchfox.org/mozilla-central/rev/f8576fec48d866c5f988baaf1fa8d2f8cce2a82f/security/nss/lib/cryptohi/secvfy.c#477">here is the code</a> for RSA-PSS. The bug is that there is simply no bounds checking at all; sig and key are  arbitrary-length, attacker-controlled blobs, and cx->u is a fixed-size buffer. <a id="t.5f5007590f34efd7a404c6d3f020f980f0b97070"></a><a id="t.2"></a><table class="c14"><tbody><tr class="c29"><td class="c15" colspan="1" rowspan="1">            case rsaPssKey:                sigLen = SECKEY_SignatureLen(key);                if (sigLen == 0) {                    /* error set by SECKEY_SignatureLen */                    rv = SECFailure;                    break;                }                if (sig->len != sigLen) {                    PORT_SetError(SEC_ERROR_BAD_SIGNATURE);                    rv = SECFailure;                    break;                }                PORT_Memcpy(cx->u.buffer, sig->data, sigLen);                break;</td></tr><tr class="c29"><td class="c15" colspan="1" rowspan="1"> Fig 3. The signature size must match the size of the key, but there are no other limitations. cx->u is a fixed-size buffer, and sig is an arbitrary-length, attacker-controlled blob.</td></tr></tbody></table> I think this vulnerability raises a few immediate questions: <ul style="padding: 0;" class="c17 lst-kix_2fd9br43vo52-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Was this a recent code change or regression that hadn’t been around long enough to be discovered? No, the original code was <a class="c91" href="https://hg.mozilla.org/projects/nss/annotate/41f5eb9e5df23951883ba3243f3ae51550663d77/security/nss/lib/cryptohi/secvfy.c#l158">checked in</a> with ECC support on the 17th October 2003, but wasn't exploitable until some <a class="c91" href="https://hg.mozilla.org/projects/nss/diff/10393/security/nss/lib/cryptohi/seckey.c#l1.63">refactoring</a> in June 2012. In 2017, RSA-PSS support was <a class="c91" href="https://hg.mozilla.org/projects/nss/rev/84e886ea090e36c69df58a71665a97bd25c62d02">added</a> and made the same error.</li></ul> <ul style="padding: 0;" class="c17 lst-kix_81cegzboe9ky-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Does this bug require a long time to generate a key that triggers the bug? No, the example above generates a real key and signature, but it can just be garbage as the overflow happens before the signature check. A few kilobytes of A’s works just fine.</li></ul> <ul style="padding: 0;" class="c17 lst-kix_2gk0zovl15u8-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Does reaching the vulnerable code require some complicated state that fuzzers and static analyzers would have difficulty synthesizing, like hashes or checksums? No, it has to be well-formed DER, that’s about it.</li></ul> <ul style="padding: 0;" class="c17 lst-kix_z8xtsan2wa5s-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Is this an uncommon code path? No, Firefox does not use this code path for RSA-PSS signatures, but the default entrypoint for certificate verification in NSS, CERT_VerifyCertificate(), is vulnerable.</li></ul> <ul style="padding: 0;" class="c17 lst-kix_oetzaqvyxxoa-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Is it specific to the RSA-PSS algorithm? No, it also affects DSA signatures.</li></ul> <ul style="padding: 0;" class="c17 lst-kix_prwgb47nvxz6-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Is it unexploitable, or otherwise limited impact? No, the hashobj member can be clobbered. That object contains <a class="c91" href="https://searchfox.org/mozilla-central/rev/41a8c58186206985c0d70d3d460c04ac844d11d0/security/nss/lib/util/hasht.h#45">function pointers</a>, which are used immediately.</li></ul> This wasn’t a process failure, the vendor did everything right. Mozilla has a mature, world-class security team. They pioneered <a class="c91" href="https://www.mozilla.org/en-US/security/bug-bounty/">bug bounties</a>, invest in <a class="c91" href="https://research.mozilla.org/rust/">memory safety</a>, fuzzing and <a class="c91" href="https://coverage.moz.tools/">test coverage</a>. NSS was one of the very first projects included with <a class="c91" href="https://google.github.io/oss-fuzz/">oss-fuzz</a>, it was officially supported since at least <a class="c91" href="https://github.com/google/oss-fuzz/commit/3d325bf20f0b09961b6c7de34aa4da0d16cfa67d">October 2014</a>. Mozilla also fuzz NSS themselves with <a class="c91" href="https://llvm.org/docs/LibFuzzer.html">libFuzzer</a>, and have contributed their own <a class="c91" href="https://searchfox.org/mozilla-central/source/security/nss/fuzz/asn1_mutators.cc">mutator</a> collection and distilled <a class="c91" href="https://github.com/mozilla/nss-fuzzing-corpus">coverage corpus</a>. There is an extensive testsuite, and nightly <a class="c91" href="https://firefox-source-docs.mozilla.org/tools/sanitizer/asan.html">ASAN</a> builds. I'm generally skeptical of static analysis, but this seems like a simple missing bounds check that should be easy to find. Coverity has been monitoring NSS since at least <a class="c91" href="https://scan.coverity.com/projects/nss">December 2008</a>, and also appears to have failed to discover this. Until 2015, Google Chrome <a class="c91" href="https://chromium.googlesource.com/chromium/third_party/nss/+/refs/heads/master/README.chromium">used</a> NSS, and maintained their own testsuite and fuzzing infrastructure independent of Mozilla. Today, Chrome platforms use <a class="c91" href="https://boringssl.googlesource.com/boringssl/">BoringSSL</a>, but the NSS port is still maintained. <ul style="padding: 0;" class="c17 lst-kix_ohd9cwgi2ci1-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Did Mozilla have good test coverage for the vulnerable areas? <a class="c91" href="https://coverage.moz.tools/#revision=latest&path=security%2Fnss%2Flib%2Fcryptohi%2Fsecvfy.c&suite=gtest&view=file&line=201">YES</a>.</li><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Did Mozilla/chrome/oss-fuzz have relevant inputs in their fuzz corpus? <a class="c91" href="https://storage.googleapis.com/oss-fuzz-coverage/nss/reports/20211027/linux/src/nss/lib/cryptohi/secvfy.c.html#L201">YES</a>.</li><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Is there a mutator capable of extending ASN1_ITEMs? <a class="c91" href="https://codereview.chromium.org/1677803002/patch/180001/190008">YES</a>.</li><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Is this an <a class="c91" href="https://github.com/google/sanitizers/wiki/AddressSanitizerIntraObjectOverflow">intra-object overflow</a>, or other form of corruption that ASAN would have difficulty detecting? NO, it's a textbook buffer overflow that ASAN can easily detect.</li></ul> <h1 class="c13 c16" id="h.rdx8pm6yen5">How did I find the bug?</h1> I've been experimenting with alternative methods for measuring code coverage, to see if any have any practical use in fuzzing. The fuzzer that discovered this vulnerability used a combination of two approaches, stack coverage and object isolation. <h2 class="c13 c16" id="h.j6f1q7cn6h69">Stack Coverage</h2> The most common method of measuring code coverage is block coverage, or <a class="c91" href="https://clang.llvm.org/docs/SanitizerCoverage.html#edge-coverage">edge coverage</a> when source code is available. I’ve been curious if that is always sufficient. For example, consider a simple dispatch table with a combination of trusted and untrusted parameters, as in Fig 4. <a id="t.bd548b01b21e1cf0cdd7eaa859aff19f6d0661e5"></a><a id="t.3"></a><table class="c14"><tbody><tr class="c29"><td class="c15" colspan="1" rowspan="1"> #include <stdio.h> #include <string.h> #include <limits.h>   static char buf[128];   void cmd_handler_foo(int a, size_t b) { memset(buf, a, b); } void cmd_handler_bar(int a, size_t b) { cmd_handler_foo('A', sizeof buf); } void cmd_handler_baz(int a, size_t b) { cmd_handler_bar(a, sizeof buf); }   typedef void (* dispatch_t)(int, size_t);   dispatch_t handlers[UCHAR_MAX] = {     cmd_handler_foo,     cmd_handler_bar,     cmd_handler_baz, };   int main(int argc, char **argv) {     int cmd;       while ((cmd = getchar()) != EOF) {         if (handlers[cmd]) {             handlers[cmd](getchar(), getchar());         }     } }</td></tr><tr class="c29"><td class="c15" colspan="1" rowspan="1"> Fig 4. The coverage of command bar is a superset of command foo, so an input containing the latter would be discarded during corpus minimization. There is a vulnerability unreachable via command bar that might never be discovered. Stack coverage would correctly keep both inputs.<a href="#ftnt1" id="ftnt_ref1" name="ftnt_ref1">[1]</a></td></tr></tbody></table> To solve this problem, I’ve been experimenting with monitoring the call stack during execution. The naive implementation is too slow to be practical, but after a lot of optimization I had come up with a library that was fast enough to be integrated into coverage-guided fuzzing, and was testing how it performed with NSS and other libraries. <h2 class="c13 c16" id="h.hx3w7e9emdvh">Object Isolation</h2> Many data types are constructed from smaller records. PNG files are made of chunks, PDF files are made of streams, ELF files are made of sections, and X.509 certificates are made of ASN.1 TLV items. If a fuzzer has some understanding of the underlying format, it can isolate these records and extract the one(s) causing some new stack trace to be found. The fuzzer I was using is able to isolate and extract interesting new ASN.1 OIDs, SEQUENCEs, INTEGERs, and so on. Once extracted, it can then randomly combine or insert them into template data. This isn’t really a new idea, but is a new implementation. I'm planning to open source this code in the future. <h2 class="c13 c16" id="h.eyoyd5te8xd4">Do these approaches work?</h2> I wish that I could say that discovering this bug validates my ideas, but I’m not sure it does. I was doing some moderately novel fuzzing, but I see no reason this bug couldn’t have been found earlier with even rudimentary fuzzing techniques. <h2 class="c13 c16" id="h.gjjikaq7urz2">Lessons Learned</h2> How did extensive, customized fuzzing with impressive coverage metrics fail to discover this bug? <h3 class="c13 c16" id="h.jjxdnfbzkeky">What went wrong</h3> <h4 class="c13 c16" id="h.tq5bofk5duby">Issue #1 Missing end-to-end testing.</h4> NSS is a <a class="c91" href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_API_Guidelines">modular</a> library. This layered design is reflected in the <a class="c91" href="https://searchfox.org/nss/source/fuzz/">fuzzing</a> approach, as each component is fuzzed independently. For example, the <a class="c91" href="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note1#how_to_use_the_nss_asn.1_and_quickder_decoders">QuickDER</a> decoder is tested <a class="c91" href="https://searchfox.org/nss/source/fuzz/quickder_target.cc">extensively</a>, but the fuzzer simply <a class="c91" href="https://searchfox.org/nss/rev/5f2fa238b58c9158a52c0681ca2a67958a353082/fuzz/quickder_target.cc#72">creates and discards</a> objects and never uses them. <a id="t.f4e0f36d5a94fbada814aadd6ad3730de37e434f"></a><a id="t.4"></a><table class="c4"><tbody><tr class="c29"><td class="c15" colspan="1" rowspan="1"> extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {  char *dest[2048];  for (auto tpl : templates) {    PORTCheapArenaPool pool;    SECItem buf = {siBuffer, const_cast<unsigned char *>(Data),                   static_cast<unsigned int>(Size)};    PORT_InitCheapArena(&pool, DER_DEFAULT_CHUNKSIZE);    (void)SEC_QuickDERDecodeItem(&pool.arena, dest, tpl, &buf);    PORT_DestroyCheapArena(&pool);  }</td></tr><tr class="c29"><td class="c15" colspan="1" rowspan="1"> Fig 5. The QuickDER fuzzer simply creates and discards objects. This verifies the ASN.1 parsing, but not whether other components handle the resulting objects correctly.</td></tr></tbody></table> This fuzzer might have produced a SECKEYPublicKey that could have reached the vulnerable code, but as the result was never used to verify a signature, the bug could never be discovered. <h4 class="c13 c16" id="h.y3p8hf8j0qqo">Issue #2 Arbitrary size limits.</h4> There is an arbitrary limit of <a class="c91" href="https://searchfox.org/nss/source/fuzz/options/quickder.options">10000 bytes</a> placed on fuzzed input. There is no such limit within NSS; many structures can exceed this size. This vulnerability demonstrates that errors happen at extremes, so this limit should be chosen thoughtfully. A reasonable choice might be 224-1 bytes, the <a class="c91" href="https://datatracker.ietf.org/doc/html/rfc8446#section-4.4.2">largest possible</a> certificate that can be presented by a server during a TLS handshake negotiation. While NSS might handle objects even larger than this, TLS cannot possibly be involved, reducing the overall severity of any vulnerabilities missed. <h4 class="c13 c16" id="h.fny13amxfoss">Issue #3 Misleading metrics.</h4> All of the NSS fuzzers are represented in combined coverage metrics by oss-fuzz, rather than their individual coverage. This data proved misleading, as the vulnerable code is fuzzed extensively but by fuzzers that could not possibly generate a relevant input. This is because fuzzers like the <a class="c91" href="https://searchfox.org/nss/source/fuzz/tls_server_target.cc">tls_server_target</a> use fixed, <a class="c91" href="https://searchfox.org/nss/source/fuzz/tls_server_certs.cc">hardcoded</a> certificates. This exercises code relevant to certificate verification, but only fuzzes TLS messages and protocol state changes. <h3 class="c13 c16" id="h.5iljytmv85wn">What Worked</h3> <ul style="padding: 0;" class="c17 lst-kix_4idwybng3hbx-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">The design of the mozilla::pkix validation library prevented this bug from being worse than it could have been. Unfortunately it is unused outside of Firefox and Thunderbird.</li></ul> It’s debatable whether this was just good fortune or not. It seems likely RSA-PSS would eventually be permitted by mozilla::pkix, even though it was not today. <h2 class="c13 c16" id="h.t0ijbutqkb5h">Recommendations</h2> This issue demonstrates that even extremely well-maintained C/C++ can have fatal, trivial mistakes. <h3 class="c13 c16" id="h.yesvwttsgrsf">Short Term</h3> <ul style="padding: 0;" class="c17 lst-kix_x7i5vtjupm2f-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">Raise the maximum size of ASN.1 objects produced by libFuzzer from 10,000 to 224-1 = 16,777,215  bytes.</li></ul><ul style="padding: 0;" class="c17 lst-kix_wy7koemfbmv1-0 start"><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">The QuickDER fuzzer should call some relevant APIs with any objects successfully created before destroying them.</li><li style="margin-left: 46pt;" class="c13 c27 li-bullet-0">The oss-fuzz code coverage metrics should be divided by fuzzer, not by project.</li></ul> <h1 class="c13 c16" id="h.i49j9otzq1oi">Solution</h1> This vulnerability is CVE-2021-43527, and is resolved in <a class="c91" href="https://www.mozilla.org/en-US/security/advisories/">NSS 3.73.0</a>. If you are a vendor that distributes NSS in your products, you will most likely need to update or backport the patch. <h1 class="c13 c16" id="h.9canxlbf0rtp">Credits</h1> I would not have been able to find this bug without assistance from my colleagues from Chrome, Ryan Sleevi and David Benjamin, who helped answer my ASN.1 encoding questions and engaged in thoughtful discussion on the topic. Thanks to the NSS team, who helped triage and analyze the vulnerability.<hr class="c44"><div> <a href="#ftnt_ref1" id="ftnt1" name="ftnt1">[1]</a> In this minimal example, a workaround if source was available would be to use a combination of sancov's data-flow instrumentation options, but that also fails on more complex variants.</div></div> <div style='clear: both;'></div> </div> <div class='post-footer'> <div class='post-footer-line post-footer-line-1'> Posted by Anonymous at <meta content='https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html' itemprop='url'/> <a class='timestamp-link' href='https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html' rel='bookmark' title='permanent link'><abbr class='published' itemprop='datePublished' title='2021-12-01T10:38:00-08:00'>10:38 AM</abbr></a> <a class='comment-link' href='https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html#comment-form' onclick=''> No comments: </a> <a href='https://www.blogger.com/post-edit.g?blogID=4838136820032157985&postID=7868790017880077590&from=pencil' title='Edit Post'> <img alt='' class='icon-action' height='18' src='https://resources.blogblog.com/img/icon18_edit_allbkg.gif' width='18'/> </a> <div class='post-share-buttons goog-inline-block'> <a class='goog-inline-block share-button sb-email' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=7868790017880077590&target=email' target='_blank' title='Email This'>Email This</a><a class='goog-inline-block share-button sb-blog' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=7868790017880077590&target=blog' onclick='window.open(this.href, "_blank", "height=270,width=475"); return false;' target='_blank' title='BlogThis!'>BlogThis!</a><a class='goog-inline-block share-button sb-twitter' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=7868790017880077590&target=twitter' target='_blank' title='Share to X'>Share to X</a><a class='goog-inline-block share-button sb-facebook' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=7868790017880077590&target=facebook' onclick='window.open(this.href, "_blank", "height=430,width=640"); return false;' target='_blank' title='Share to Facebook'>Share to Facebook</a><a class='goog-inline-block share-button sb-pinterest' href='https://www.blogger.com/share-post.g?blogID=4838136820032157985&postID=7868790017880077590&target=pinterest' target='_blank' title='Share to Pinterest'>Share to Pinterest</a> </div> </div> <div class='post-footer-line post-footer-line-2'> </div> <div class='post-footer-line post-footer-line-3'> </div> </div> </div> </div> </div></div> </div> <div class='blog-pager' id='blog-pager'> <a class='blog-pager-newer-link' href='https://googleprojectzero.blogspot.com/search?updated-max=2022-02-10T08:58:00-08:00&max-results=1&reverse-paginate=true' id='Blog1_blog-pager-newer-link' title='Newer Posts'>Newer Posts</a> <a class='blog-pager-older-link' href='https://googleprojectzero.blogspot.com/search?updated-max=2021-12-01T10:38:00-08:00&max-results=1' id='Blog1_blog-pager-older-link' title='Older Posts'>Older Posts</a> <a class='home-link' href='https://googleprojectzero.blogspot.com/'>Home</a> </div> <div class='clear'></div> <div class='blog-feeds'> <div class='feed-links'> Subscribe to: <a class='feed-link' href='https://googleprojectzero.blogspot.com/feeds/posts/default' target='_blank' type='application/atom+xml'>Posts (Atom)</a> </div> </div> </div></div> </div> </div> <div class='column-left-outer'> <div class='column-left-inner'> <aside> </aside> </div> </div> <div class='column-right-outer'> <div class='column-right-inner'> <aside> <div class='sidebar section' id='sidebar-right-1'><div class='widget BlogSearch' data-version='1' id='BlogSearch1'> <h2 class='title'>Search This Blog</h2> <div class='widget-content'> <div id='BlogSearch1_form'> <form action='https://googleprojectzero.blogspot.com/search' class='gsc-search-box' target='_top'> <table cellpadding='0' cellspacing='0' class='gsc-search-box'> <tbody> <tr> <td class='gsc-input'> <input autocomplete='off' class='gsc-input' name='q' size='10' title='search' type='text' value=''/> </td> <td class='gsc-search-button'> <input class='gsc-search-button' title='search' type='submit' value='Search'/> </td> </tr> </tbody> </table> </form> </div> </div> <div class='clear'></div> </div><div class='widget PageList' data-version='1' id='PageList1'> <h2>Pages</h2> <div class='widget-content'> <ul> <li> <a href='https://googleprojectzero.blogspot.com/p/about-project-zero.html'>About Project Zero</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/working-at-project-zero.html'>Working at Project Zero</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/0day.html'>0day "In the Wild"</a> </li> <li> <a href='https://googleprojectzero.github.io/0days-in-the-wild/rca.html'>0day Exploit Root Cause Analyses</a> </li> <li> <a href='https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html'>Vulnerability Disclosure FAQ</a> </li> </ul> <div class='clear'></div> </div> </div><div class='widget BlogArchive' data-version='1' id='BlogArchive1'> <h2>Archives</h2> <div class='widget-content'> <div id='ArchiveList'> <div id='BlogArchive1_ArchiveList'> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2025/'> 2025 </a> (2) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2025/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/'> 2024 </a> (12) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/12/'> December </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2024/04/'> April </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/'> 2023 </a> (11) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/08/'> August </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2023/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/'> 2022 </a> (17) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/11/'> November </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/02/'> February </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2022/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate expanded'> <a class='toggle' href='javascript:void(0)'> ▼  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/'> 2021 </a> (24) <ul class='hierarchy'> <li class='archivedate expanded'> <a class='toggle' href='javascript:void(0)'> ▼  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/12/'> December </a> (2) <ul class='posts'> <li><a href='https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html'>A deep dive into an NSO zero-click iMessage exploi...</a></li> <li><a href='https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html'>This shouldn't have happened: A vulnerability post...</a></li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/10/'> October </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/06/'> June </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/02/'> February </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2021/01/'> January </a> (10) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/'> 2020 </a> (36) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/09/'> September </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/08/'> August </a> (5) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/07/'> July </a> (8) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/06/'> June </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/02/'> February </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2020/01/'> January </a> (5) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/'> 2019 </a> (27) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/08/'> August </a> (11) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/04/'> April </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/02/'> February </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2019/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/'> 2018 </a> (22) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/12/'> December </a> (7) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/10/'> October </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/08/'> August </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/06/'> June </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2018/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/'> 2017 </a> (19) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/10/'> October </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/08/'> August </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/04/'> April </a> (6) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/03/'> March </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2017/02/'> February </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/'> 2016 </a> (17) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/11/'> November </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/09/'> September </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/08/'> August </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/07/'> July </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/06/'> June </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/03/'> March </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/02/'> February </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2016/01/'> January </a> (1) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/'> 2015 </a> (33) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/12/'> December </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/10/'> October </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/09/'> September </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/08/'> August </a> (6) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/07/'> July </a> (5) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/06/'> June </a> (4) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/05/'> May </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/04/'> April </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/03/'> March </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/02/'> February </a> (3) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2015/01/'> January </a> (2) </li> </ul> </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/'> 2014 </a> (11) <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/12/'> December </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/11/'> November </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/10/'> October </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/09/'> September </a> (1) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/08/'> August </a> (2) </li> </ul> <ul class='hierarchy'> <li class='archivedate collapsed'> <a class='toggle' href='javascript:void(0)'> ►  </a> <a class='post-count-link' href='https://googleprojectzero.blogspot.com/2014/07/'> July </a> (3) </li> </ul> </li> </ul> </div> </div> <script type='text/javascript'> //<![CDATA[ (function(){ let archive_list = document.getElementById('ArchiveList'); if (archive_list == null) return; let cur_year = archive_list.querySelector('.post-count-link').innerText.trim() - 0; let last_year = 2014; let elements = []; const MONTHS = ',Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec'.split(','); let parent = document.getElementById('ArchiveList'); while (parent.childNodes.length) parent.removeChild(parent.childNodes[0]); function fetch_next_year() { let url = 'https://googleprojectzero.blogspot.com/?action=getTitles&widgetId=BlogArchive1&widgetType=BlogArchive&responseType=js&path=https%3A%2F%2Fgoogleprojectzero.blogspot.com%2F'+cur_year; fetch(url).then(resp => { if (!resp.ok) { console.log('http error'); return; } resp.text().then(text => { let scope = { _WidgetManager: { _HandleControllerResult: (name, method, results) => { elements.push(document.createElement('hr')); let year_header = document.createElement('div'); year_header.appendChild(document.createTextNode(cur_year)); year_header.style.fontSize = 'large'; elements.push(year_header); let list = document.createElement('ul'); elements.push(list); for (let obj of results.posts) { let link_parts = obj.url.split('/'); let year = link_parts[3]; let month = link_parts[4]; let el = document.createElement(/*'div'*/'li'); el.style.listStyleType = 'square'; el.style.listStylePosition = 'inside'; let link = document.createElement('a'); el.appendChild(link); link.appendChild(document.createTextNode(obj.title)); link.href = obj.url; let date_trailer = document.createElement('span'); el.appendChild(date_trailer); //date_trailer.appendChild(document.createTextNode(' ('+year+'-'+month+')')); date_trailer.appendChild(document.createTextNode(' ('+MONTHS[parseInt(month, 10)]+')')); //date_trailer.style.textAlign = 'right'; //elements.push(el); list.appendChild(el); } } } }; with (scope) { eval(text); } if (cur_year == last_year) { finish(); } else { cur_year--; fetch_next_year(); } }); }); } fetch_next_year(); function finish() { for (let obj of elements) { parent.appendChild(obj); } console.log(elements); } })(); //]]> </script> <div class='clear'></div> </div> </div></div> <table border='0' cellpadding='0' cellspacing='0' class='section-columns columns-2'> <tbody> <tr> <td class='first columns-cell'> <div class='sidebar no-items section' id='sidebar-right-2-1'></div> </td> <td class='columns-cell'> <div class='sidebar no-items section' id='sidebar-right-2-2'></div> </td> </tr> </tbody> </table> <div class='sidebar no-items section' id='sidebar-right-3'></div> </aside> </div> </div> </div> <div style='clear: both'></div>  </div>  </div> </div> <div class='main-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> <footer> <div class='footer-outer'> <div class='footer-cap-top cap-top'> <div class='cap-left'></div> <div class='cap-right'></div> </div> <div class='fauxborder-left footer-fauxborder-left'> <div class='fauxborder-right footer-fauxborder-right'></div> <div class='region-inner footer-inner'> <div class='foot no-items section' id='footer-1'></div> <table border='0' cellpadding='0' cellspacing='0' class='section-columns columns-2'> <tbody> <tr> <td class='first columns-cell'> <div class='foot no-items section' id='footer-2-1'></div> </td> <td class='columns-cell'> <div class='foot no-items section' id='footer-2-2'></div> </td> </tr> </tbody> </table>  <div class='foot section' id='footer-3' name='Footer'><div class='widget Attribution' data-version='1' id='Attribution1'> <div class='widget-content' style='text-align: center;'> Powered by <a href='https://www.blogger.com' target='_blank'>Blogger</a>. </div> <div class='clear'></div> </div></div> </div> </div> <div class='footer-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </footer>  </div> </div> <div class='content-cap-bottom cap-bottom'> <div class='cap-left'></div> <div class='cap-right'></div> </div> </div> </div> <script type='text/javascript'> window.setTimeout(function() { document.body.className = document.body.className.replace('loading', ''); }, 10); </script> <script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/688949419-widgets.js"></script> <script type='text/javascript'> window['__wavt'] = 'AOuZoY5eZmOfBlhbMriTb96VPIv5qdBrYw:1739857327226';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d4838136820032157985','//googleprojectzero.blogspot.com/2021/','4838136820032157985'); _WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '4838136820032157985', 'title': 'Project Zero', 'url': 'https://googleprojectzero.blogspot.com/2021/', 'canonicalUrl': 'https://googleprojectzero.blogspot.com/2021/', 'homepageUrl': 'https://googleprojectzero.blogspot.com/', 'searchUrl': 'https://googleprojectzero.blogspot.com/search', 'canonicalHomepageUrl': 'https://googleprojectzero.blogspot.com/', 'blogspotFaviconUrl': 'https://googleprojectzero.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'UA-240546891-1', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Project Zero - Atom\x22 href\x3d\x22https://googleprojectzero.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22Project Zero - RSS\x22 href\x3d\x22https://googleprojectzero.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Project Zero - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/4838136820032157985/posts/default\x22 /\x3e\n', 'meTag': '', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': false, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/f6e0cc369f0f1a05', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Share to X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'archive', 'pageName': '2021', 'pageTitle': 'Project Zero: 2021'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': false, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Project Zero', 'description': 'News and updates from the Project Zero team at Google', 'url': 'https://googleprojectzero.blogspot.com/2021/', 'type': 'feed', 'isSingleItem': false, 'isMultipleItems': true, 'isError': false, 'isPage': false, 'isPost': false, 'isHomepage': false, 'isArchive': true, 'isLabelSearch': false, 'archive': {'year': 2021, 'rangeMessage': 'Showing posts from 2021'}}}]); _WidgetManager._RegisterWidget('_NavbarView', new _WidgetInfo('Navbar1', 'navbar', document.getElementById('Navbar1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'header', document.getElementById('Header1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'main', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/1360229384-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/1964470060-lightbox_bundle.css'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogSearchView', new _WidgetInfo('BlogSearch1', 'sidebar-right-1', document.getElementById('BlogSearch1'), {}, 'displayModeFull')); _WidgetManager._RegisterWidget('_PageListView', new _WidgetInfo('PageList1', 'sidebar-right-1', document.getElementById('PageList1'), {'title': 'Pages', 'links': [{'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/about-project-zero.html', 'id': '4384467920505278144', 'title': 'About Project Zero'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/working-at-project-zero.html', 'id': '2459334498880008057', 'title': 'Working at Project Zero'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/0day.html', 'id': '3414239791814532209', 'title': '0day \x22In the Wild\x22'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.github.io/0days-in-the-wild/rca.html', 'title': '0day Exploit Root Cause Analyses'}, {'isCurrentPage': false, 'href': 'https://googleprojectzero.blogspot.com/p/vulnerability-disclosure-faq.html', 'id': '2935252455704572784', 'title': 'Vulnerability Disclosure FAQ'}], 'mobile': false, 'showPlaceholder': true, 'hasCurrentPage': false}, 'displayModeFull')); _WidgetManager._RegisterWidget('_BlogArchiveView', new _WidgetInfo('BlogArchive1', 'sidebar-right-1', document.getElementById('BlogArchive1'), {'languageDirection': 'ltr', 'loadingMessage': 'Loading\x26hellip;'}, 'displayModeFull')); _WidgetManager._RegisterWidget('_AttributionView', new _WidgetInfo('Attribution1', 'footer-3', document.getElementById('Attribution1'), {}, 'displayModeFull')); </script> </body> </html>