Linux

The Whisper_Bully tool demonstrates a sophisticated three-stage attack against Bluetooth Fast Pair devices. It leverages a specific vulnerability to bypass privacy randomization, followed by L2CAP flooding and connection hijacking.

Researcher Hyunwoo Kim discovered a high-severity use-after-free vulnerability in the Linux KVM subsystem called Januscape. This flaw enables untrusted guest VMs to break out of their isolation and potentially take control of the host operating system.

A new side-channel attack named FROST allows websites to bypass browser sandboxing by analyzing SSD latency. By using deep learning to process I/O traces, attackers can fingerprint the applications and websites running on a user's device.

Hyunwoo Kim has announced Dirty Frag, a zero-day local privilege escalation vulnerability that enables root access on all major Linux distributions. The disclosure includes functional exploit code and a script to mitigate the threat by removing vulnerable modules.