Type here to search all available records…
18,452 VEX records have been documented by SIMULACRUM authorities.
ⓘ Unsure how to continue? Refer below for further information.
OVERVIEW
Security is crucial to Project SIMULACRUM's continued success. The Vulnerability Exposure Index (VEX) database provides a centralized catalogue for disclosing and documenting known threats to SIMULACRUM's environment, inhabitants, items, virtual sandboxes, and external infrastructure. VEX records are enumerated by their entry IDs (VEX-YYYY-NNN) which documents the year that the identified vulnerability was discovered in and a unique sequence numerical for categorization.
RECENT RECORDS
| VEX ID: | VEX-2045-003 | SEVERITY: | 7.4 | ||
|---|---|---|---|---|---|
| RELATED ITEMS: | |||||
| DESCRIPTION: | |||||
|
Improper access controls across SIMULACRUM meshlayer firmware versions would allow affected players to bypass predefined world boundaries. This, in essence, allowed for uninterrupted access to any bordering sandboxes. In some versions, players were not only able to bypass these borders, but could also access edit parameters within their sandbox, thus granting them access to elevated administrator commands. |
|||||
| REPERCUSSIONS: | |||||
|
Simulations bordering vulnerable sandboxes were mostly reserved for testing and containment of undocumented large-scale virtual aggressors (LSVAs) or other unknown anomalous phenomenon. Players exploiting this vulnerability could disrupt these simulations through physical interaction or by executing elevated commands. Players with internal system access to their own sandboxes could also "piggyback" off their instances and into other remote sandboxes. In one case, several unknown attackers were able to sabotage the SCP-6882 virtual instance and hijack its noospheric platform interface, causing connected players to undergo rapid mental and physical deterioration before an unexpected sandbox crash later occured. Attackers were able to successfully input coordinate commands to bypass detection; however, improper values resulted in threat actors falling out-of-bounds and missing subsequent bound checks. Recovery efforts have been futile. |
|||||
| MITIGATION: | |||||
| Firmware updates are available for all affected virtual sandboxes. Complete system restart is necessary to apply changes. Additional vendor-specific hotfix patches have been successfully deployed across all platforms and unattached virtual instances. | |||||
| STATUS: | ERADICATED | IMPACT: | Low | AUTHORITY: | Dr. Jakob Reigen |
| VEX ID: | VEX-2032-682 | SEVERITY: | 9.8 | ||
|---|---|---|---|---|---|
| RELATED ITEMS: | |||||
|
|||||
| DESCRIPTION: | |||||
| Unsecured data root paths between sandboxes from the PRIME INDEX could allow semiohazardous phenomenon to affect multiple SIMULACRUM layers. | |||||
| REPERCUSSIONS: | |||||
|
Disaster recovery systems flagged and restored a cascading network file system crash after a failed interaction between two sandboxes. Prior to the alerted incident, SIMULA-9025-1B — an abstracted reality intended to test interactions between ontokinetic, semiohazardous, and other reality-altering anomalies — had initiated a resource request from SIMULA-7621-3C. During the response operation by SIMULA-7621-3C, an undetected HAZARD was also transferred. This COMPLEX was then successfully executed after both sandboxes confirmed its presence and attempted to forcibly delete the THREAT. Due to outdated data signatures, the HAZARD began systematically updating all reference pointers, files, and datasets with abstractions, halting system functions across 3,451 connected instances. COMPLEX manifested itself within SIMULA-9025-1B, alerting host player MAKER. Attempts by MAKER to notify SIMULACRUM administrators of the MALWARE2 subsequently failed as null counters disrupted operations. Automated systems were unable to fully repair either sandboxes or regenerate MAKER from backup player matrices. |
|||||
| MITIGATION: | |||||
|
Standard requests sent by client and serving sandboxes have been updated to introduce an additional CHECK flag to determine if data being sent or received contains anomalous traces. Host-based detection/removal systems have also been updated across all active SIMULACRUM instances to cleanse deployments of potential reality-altering hazards. PRIME INDEX roots have been updated to utilize the latest security protocols. Improved pathing methods between sandboxes have also been introduced to now disconnect instances determined to be at risk of anomalous leakage. SIMULACRUM authorities have all received additional training on dealing with active cognitive hazards, including semiohazardous and infohazardous phenomenon. |
|||||
| STATUS: | ACTIVE | IMPACT: | CRITICAL | AUTHORITY: | Dr. Devin Collins |
| VEX ID: | VEX-2423-019 | SEVERITY: | 4.8 | ||
|---|---|---|---|---|---|
| RELATED ITEMS: | |||||
| DESCRIPTION: | |||||
|
A buffer overflow in the commit_action module in SCP-6872 would incorrectly reference SCP-2718, resulting in multiple errors and extraordinary physical harm onto players. Continued conflicts could cause a denial of service (crash) and possibly execute additional root-level commands. In some instances, players experiencing multiple requests between both SCP-6872 and SCP-2718 could also be afflicted by both conditions simultaneously, leading to corrupted reference caches and other errors. |
|||||
| REPERCUSSIONS: | |||||
|
During the rapid deployment of sub-simulations within SCP-6872, an increased strain on incoming state requests resulted in players being incorrectly assigned to SCP-2718. During this period, players experiencing the "DECEASED" state would not be transported to their simulated death sequences— rather, affected individuals would either be terminated from their hosting simulation entirely or remain permanently immobile and unable to disconnect from their sessions. This resulted in players being in multiple states of "DECEASED" between several sandboxes. In other circumstances, physical players would be completely ejected from all sandboxes. Excessive electric discharge caused by the vulnerability sent uncontrolled shocks through sensitive neural interfaces, physically disabling players and locking their player pods indefinitely. Players would still report active heartbeats despite being clinically deceased, bypassing all system monitoring tools for extended periods of time. This resulted in player pods being contaminated with excess organisms, including bacteria, mites, mold, and flies. All later attempts to remove players from their pods universally ended in failure. |
|||||
| MITIGATION: | |||||
| Additional software-level checks against possible overflows have been implemented to prevent any issues with SCP-6872 and SCP-2718. Additional system monitoring tools have been implemented to confirm player status through haptic and audio feedback. All active neural network interfaces have also been issued a firmware update and all player pods have been refitted with emergency release latches. | |||||
| STATUS: | REMEDIED | IMPACT: | Medium | AUTHORITY: | [AUTOMATED] |
| VEX ID: | VEX-2076-303 | SEVERITY: | 1.7 | ||
|---|---|---|---|---|---|
| RELATED ITEMS: | |||||
|
|||||
| DESCRIPTION: | |||||
| On Docker versions that form a valid number string in binary, cron would read it as a valid character string instead. This would cause various issues, including system failure. | |||||
| REPERCUSSIONS: | |||||
|
SIMULA-Y200-2K is a sandboxed reality designed to output a single value — the default system time of baseline reality pre-SIMULACRUM. This is done to maintain legacy systems that expect a standard time on certain functions instead of the advanced system time of IEEE 4098.32, the standardized SIMULACRUM timestamp. Retrieval of the legacy system timestamp is done through a cron script, which first checks for the current Docker version, and only fetches a new system timestamp if the version number had recently changed. Due to issues with cron, Docker version number strings would sometimes be misinterpreted as invalid character strings when updated. Because of this, severe momentary failure for all SIMULA instances that depended on the legacy system time occurred. As of 2075, 321 SIMULA instances were dependent on legacy timestamps, subsequently leading to indirect system failures of those sandboxes and 8,321,098,321 other connected dependencies. |
|||||
| MITIGATION: | |||||
| A patch to cron's developer has been sent to disable interpretation of binary strings as regular characters. System administrators are currently collaborating with Docker to ensure that no version number is an interpretable character string. | |||||
| STATUS: | REMEDIED | IMPACT: | CRITICAL | AUTHORITY: | Dr. Basir |
CONTRIBUTION
Contributions can be made using the following VEX record format:
Note that only a single color (VIOLET, GREEN, BLUE, ORANGE, or RED) should be selected when using a [[div]] or [[span]], if required. For example, in order to properly display a colored word like FUTILE, please use the following formatting:
[[span class="red"]]FUTILE[[/span]]
Alternatively, if a VEX record needs to be BLUE, please encapsulate your VEX record table with the following syntax:
[[div class="blue"]]
…
[[/div]]
Upon documenting a VEX record, please be sure to verify that all of the formatting is correct and accurate. If there are no issues, a new VEX record should populate in the Recent Records section.