RCE on Xiaomi 13 Pro (CVE-2023-26324)
👉Exploitation:
1) Open URL in WebView
2) Inject JavaScript
3) Execute JavaScript Interface functions from vulnerable GetApps to install & launch payload
4) Get shell
Slides with PoC: https://t.co/7zowt65UIA by @Yogehi@040xZx at #DEFCON23
NEW: A research team led by Oxford & @Cambridge_Uni have created new ‘origami-inspired’ brain electrodes that can fold up to a fraction of their full size.
This advance could significantly reduce the amount of surgery needed to treat conditions such as epilepsy.
=>
"Will HPC be a next decade disruptor, or will it be disrupted?", Eric Monchalin, Chair of EPI & VP at Eviden,, Keynote, MPSoC 2024, Jul 9 https://t.co/0lfBx6ydPI
Fugaku-NEXT, RIKEN, Jan 19/Jun 17 https://t.co/tc0OQ0YMXm
OLCF-6
Mateo Valero, BSC, Mar 1 https://t.co/sOYKGgagZm
Regarding CVE-2024-38063 IPV6 RCE in Windows...
After reading RFCs about optional headers in IPv6 packets, I managed to create POC to cause a crash. The bug check in this case isn't too detailed, but essentially the underflow creates a large value used in a loop which eventually write data out of bounds and causes a crash.
I imagine this can be weaponized using heap massaging techniques and corrupting adjacent objects in the heap.
As many have already stated before, this can easily be mitigated by applying the latest patches or disabling IPv6 (which is enabled by default).