/explore

Click through on any links that interest you or select the planets on the right to continue exploring the Outer Web.
You are here

 www.willsroot.io
Will's Root: CVE-2022-0185 - Winning a $31337 Bounty after Pwning Ubuntu and Escaping Google's KCTF Containers
| | google.github.io
CVE-2021-22555: Turning \x00\x00 into 10000$ | security-research
2.9 parsecs away

Travel
| | This project hosts security advisories and their accompanying proof-of-concepts related to research conducted at Google which impact non-Google owned code.
| | a13xp0p0v.tech
Four Bytes of Power: Exploiting CVE-2021-26708 in the Linux kernel | Alexander Popov
3.6 parsecs away

Travel
| | CVE-2021-26708 is assigned to five race condition bugs in the virtual socket implementation of the Linux kernel. I discovered and fixed them in January 2021. In this article I describe how to exploit them for local privilege escalation on Fedora 33 Server for x86_64, bypassing SMEP and SMAP.
| | dayzerosec.com
Analyzing Android's CVE-2019-2215 (/dev/binder UAF)
3.3 parsecs away

Travel
| | Over the past few weeks, those of you who frequent the DAY[0] streams over on our Twitch may have seen me working on trying to understand the recent Android Binder Use-After-Free (UAF) published by Google's Project Zero (p0). This bug is actually not new, the issue was discovered and fixed in the mainline kernel in February 2018, however, p0 discovered many popular devices did not receive the patch downstream. Some of these devices include the Pixel 2, the Huawei P20, and Samsung Galaxy S7, S8,
| | syst3mfailure.io
[corCTF 2021] Wall Of Perdition: Utilizing msg_msg Objects For Arbitrary Read And Arbitrary Write In The Linux Kernel
6.0 parsecs away

Travel
| Wall of Perdition is the second and harder part of a two part series of kernel exploitation challenges designed by FizzBuzz101 and me for corCTF 2021. You can find the writeup for the first part, Fire of Salvation, on his blog. Unfortunately, both challenges during competition remained unsolved. Wall of Perdition consists of a vulnerable Linux Kernel Module, the bug is a 0x30 bytes Use After Free Write in kmalloc-64. With this challenge, we present a new approach to transform the Linux kernel's IPC mechanism, more specifically, message operations, in an exploitation toolkit. Let's get started!