3 ms·
This "check the block signature and then read another one" bug is incredibly common. I'd say it's one of the top 5 bugs I see in Validating Things. Other exampl
by bri3d 2y ago
This "check the block signature and then read another one" bug is incredibly common. I'd say it's one of the top 5 bugs I see in Validating Things. Other examples of places I've seen this recently include some variants of VW AG infotainment systems (mostly MIB2 High, I think), but it's kind of everywhere (as was the `strncmp-a-hash` method of validating an RSA-PKCS#1.5 signature).
This is probably the most egregious/impactful manifestation of it, though, especially if it applies to Xbox.
- mdaniel 2y ago> This "check the block signature and then read another one" bug is incredibly common I don't have links handy, but Android fell prey to this bug twice checking .apk signatures due to .zip files having duplicated copies of the manifest