Zero-day vulnerabilities caused by bad security patches

A zero-day represents a previously unidentified software vulnerability. They are very dangerous because it takes time for them to be discovered, time in which bad actors can exploit them uninterruptedly. According to Google security researchers, there were 24 0-days discovered in 2020, and incomplete security patches caused a good number of them.

Microsoft’s response to the attacks on their old JScript engine can be used as an example. Back in January 2018, there were a number of Internet Explorer vulnerabilities reported. A fix was released by the end of the year, along with a 0-day vulnerability which was discovered several months later.

“Looking at them all together as a group, the number that stuck out the most to me was that six out of the 24 zero-days exploited in 2020 are variants of previously disclosed vulnerabilities. […] On top of that, three out of the 24 vulnerabilities were incompletely patched, meaning that with just a few tweaks, you could have an exploit that still works even after the patch was applied.”

Maddie Stone – Google security researcher