Getting root of Huawei p60 pro(103.1.0.132) with 1-day kernel vulnerability. Completely locked down, an unavailable of panic logs and can't find the firmware image matching to my device were really tricky managing to.
@p1k4l4 CONFIG_XEN_PV is enabled on ubuntu so kernel addresses noted with ELFNOTE macro is in the between __start_notes and __stop_notes section. This section can read through "/sys/kernel/notes" via any user since this sysfs file mode is registered with S_IRUGO(read all permission)
It is interesting to see similar shift/unshift race condition issues that i found and exploited webkit in 2018 (https://t.co/K4HPKoaDXv) are exploited on safari, chrome these days as an in the wild bug
Apple Safari In-The-Wild memory corruption vulnerability (CVE-2023-42917 [265067]) happens because flattenDictionaryStructure can shrink butterfly for named properties (like Array shift/unshift) and got exploited by triggering a race condition:
https://t.co/LJyHF4QQSr
I've had experience on blockchain 1 years ago, which was new area for me, did bounty on @immunefi and rewarded. Was good experience for learning new thing :) I've set my wallet address to FTX for reward and remained it, but FTX is now.. anyway writeup is: https://t.co/Gpogax7jyk
Found two Samsung exynos kernel bug a month ago. Samsung seems using minor security update website for the exynos device since this year. https://t.co/OSBKTPeYGx
@dmxcsnsbh Oops, that link was broken :( that is https://t.co/bCvuVGTHGW Bug was ArrayStorage or SlowPutArrayStorage array's structure (butterfly) can change by shift/unshift interpreter function while compiling DFG and handling GetByVal opcode on DFGAI phase.
Pwn2own 2023 is coming in now. This pwn2own season remind us that we pwned microsoft teams (unfortunately we failed in real round). Here is our first blog post about our journey of pwn2own 2022 microsoft teams RCE.
https://t.co/FQ5682AUjL
I don't know what is a CVE number for my spooler EoP 0-day that i discovered last year. Anyway It was patched by microsoft tuesday patch, So I'm sharing this PoC one of the bug that listed on the screenshot for spooler EoP here: https://t.co/51k1A3SUW7