Zero-Day Vulnerability
- •
def
- •
a vulnerability that is discovered and potentially exploited before the vendor has released a patch for it — the vendor has no idea it exists and has no fix for an unknown problem
- •
- •
significance
- •
requires unscheduled, often urgent patching once discovered, in contrast to regular scheduled patch cycles; a race between attackers exploiting it and defenders patching it
- •
- •
tracking
- •
discovered vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures) at https://www.cve.org/
- •
- •
real-world examples
- •
April 2023 — a Chrome zero-day involving memory corruption and sandbox escape
- •
May 2023 — a Microsoft secure boot zero-day allowing an attacker to run self-signed code at the UEFI level
- •
May 2023 — three actively-exploited Apple iOS/iPadOS zero-days (sandbox escape, sensitive information disclosure, arbitrary code execution)
- •
- •
related
- •