Saint EvilESP, Who Travelled Encrypted

Patron of IPsec packets, badly reassembled fragments, and servers with IPsec turned on without anyone knowing.

Life

Fixed by Microsoft in September 2022 and dissected by IBM X-Force in January 2023, he hid in Windows' TCP/IP stack, in the handling of IPsec ESP packets. Carefully crafted fragments led to an out-of-bounds write in the kernel: remote code execution, no credentials needed, on machines with IPsec enabled.

Prayer

O Saint EvilESP, who enters encrypted and leaves as kernel, protect our network stacks from wicked fragments. Amen.

How to celebrate

Celebrated by installing September's updates in January, as ancient corporate tradition demands.

Not everything encrypted is innocent.