Research — NULLWARDEN

Recent work

Published findings

Severity uses CVSS where it is meaningful, but the note field is what you should read first.

Kernel privilege escalation via io_uring registration race

A user namespace could be escaped by racing registered file descriptors against a namespace teardown. Fixed in 6.9.31 and 7.1.8.

8.4

Signed firmware update accepted without verification on industrial controllers

Rollback protection could be bypassed by truncating the version metadata in the update container, allowing installation of signed-but-vulnerable firmware.

9.1

Non-constant-time comparison in session token validation

Timing differences on token comparison allowed partial recovery of valid session tokens over a network. Rewritten to use a constant-time primitive.

7.4

Heap overflow in a widely deployed media container parser

A malformed subtitle track overflowed a fixed-size buffer during format probing. Exploitable as a remote code execution in the affected daemon.

9.8

Excessive cloud role permissions in a widely used CI template

A default CI configuration granted wildcard permissions on the CI role, allowing a build-time compromise to reach production accounts.

8.1

Tooling

Tools we built and released

Research tooling is public where it can be. These are maintained, documented and used in production engagements.

nwfuzz

A coverage-guided fuzzer that runs entirely inside a hypervisor. It targets kernel interfaces without needing a disposable host, which makes deep kernel exploration practical for the first time.

kernel coverage-guided hypervisor

hardenctl

Measures the actual runtime cost of a hardening control on your target hardware and reports it as a regression baseline. Turns "this is slower" into a number you can take to a board.

baseline measurement CI

parselab

A differential parser harness that runs two implementations of the same format against each other and reports divergence. Built after a bug where our parser and a vendor's parser disagreed on a single byte.

parsing differential

iamgraph

Maps effective permissions across every role and trust policy in a cloud account and renders the shortest path to administrative access. Finds the escalation route your own tooling does not show you.

cloud IAM

Policy

How we disclose

We report to the vendor first, privately, with a working proof of concept and a clear description of impact.

We propose a 90-day window for critical issues and 180 days otherwise. If a deadline passes without a fix, we will publish — but we will always tell you first, and we will always give you something to detect the issue in the meantime.

Where a bug affects critical infrastructure or safety-critical systems, we notify the relevant national CERT regardless of the vendor's timeline.

Reporting a vulnerability to us

If you have found a vulnerability in our systems or our published tooling, we want to hear about it.

Email security@nullwarden.com. We acknowledge within one business day and do not pursue legal action against researchers who act in good faith, stay within the published scope, and give us reasonable time to fix an issue before disclosure.

We run a safe harbour policy and a bug bounty programme. Scope, exclusions and the current reward table are available on request.

Want this level of depth on your estate?

Every engagement produces the same rigour as our published research, with the findings kept private to you.

Talk to a researcher

Bugs, proofs, and the reasoning behind them.