• booly@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      6
      ·
      edit-2
      6 months ago

      disclosed active exploitation

      So, not a fucking zero day.

      I’m confused. Isn’t an active exploit that hasn’t been patched yet, by definition, a zero day? So the release of a new patch that closes an actively exploited vulnerability patches a zero-day?

        • booly@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          6
          ·
          6 months ago

          A zero day is an exploit that has been identified by someone but not yet used.

          I’ve always understood that the counting of days comes from the vendor’s knowledge. So any exploit from before Google was aware of the vulnerability would be a zero day.

          It wouldn’t make any sense to refer to the days counted from when an attacker first discovers the vulnerability, because by definition any vulnerability in active exploitation wouldn’t be a zero day.

    • xycu@programming.dev
      link
      fedilink
      English
      arrow-up
      1
      ·
      6 months ago

      The acronym GOAT has been around since well before those zoomers were born, probably before most of their parents were born, so don’t feel too embarrassed!

  • bigkahuna1986@lemmy.ml
    link
    fedilink
    English
    arrow-up
    3
    ·
    6 months ago

    Any chance we’ll be able to use these to gain root on a Pixel without unlocking the bootloader?

  • Quereller@lemmy.one
    link
    fedilink
    English
    arrow-up
    1
    ·
    6 months ago

    What is in the dumped memory (for CVE-2024-29745 )?

    Can the device encryption keys be extracted from this ? Or is it more random data?