Week of May 13, 2024

A proof-of-concept demonstrates EDR evasion by calling Windows kernel syscalls directly from Rust, bypassing user-mode hooks. The technique, known as Hells Gate, avoids detection by not using the standard Windows API. This implementation shows how Rust can be used for such evasion, previously common in C.

A publicly available patch for QEMU modifies emulated hardware identifiers to bypass virtual machine detection by several anti-cheat engines and software protectors. The technique hides QEMU-specific strings, serial numbers, and firmware artifacts but does not address timing-based detection methods. This research proof-of-concept demonstrates a practical method for evading endpoint security tools that rely on VM detection.

CVE-2024-22268 is an out-of-bounds write vulnerability in the SVGA virtual device of VMware Workstation and Fusion. It allows a remote attacker with user interaction to execute arbitrary code on the host from a guest, potentially compromising the hypervisor and all guest systems. Patches are available in Workstation 17.5.2 and Fusion 13.5.2.

CVE-2024-27834 is a vulnerability in Apple's Pointer Authentication mechanism that allows an attacker with arbitrary read/write capability to bypass pointer integrity checks. The flaw was addressed in iOS 17.5, iPadOS 17.5, and other Apple OS updates. Successful exploitation could lead to arbitrary code execution or privilege escalation.