Tags
Exploiting HackSys Extreme Vulnerable Driver (HEVD) on Windows 7 x86: a kernel stack buffer overflow using token-stealing shellcode, and privilege escalation via a Write-What-Where overwrite of the HalDispatchTable
Read full articleAnalysis of an Integer Overflow (SMBGhost) and an uninitialized kernel memory leak (SMBleed) in the SMBv3.1.1 decompression routine, and a Pre-Auth RCE achieved by chaining the two bugs
Read full articleMounting a crafted f2fs image and running operations triggers a slab out-of-bounds read in ttm_put_pages.
Read full articleMounting a crafted btrfs image and running operations triggers a slab out-of-bounds write in __btrfs_map_block.
Read full articleMounting a crafted f2fs image triggers a NULL pointer dereference in f2fs_recover_fsync_data.
Read full articleMounting a crafted f2fs image triggers a slab out-of-bounds write in __remove_dirty_segment.
Read full articleA syncfs syscall after operations on a crafted btrfs image triggers a use-after-free reached via mutex_can_spin_on_owner.
Read full articleMounting a crafted f2fs image triggers a slab out-of-bounds read in init_min_max_mtime.
Read full articleA syncfs syscall after operations on a crafted btrfs image triggers a use-after-free in try_merge_free_space.
Read full articleMounting a crafted ext4 image, running a few operations, then unmounting triggers a use-after-free in ext4_put_super.
Read full articleMounting a crafted btrfs filesystem image leads to a slab-out-of-bounds write in index_rbio_pages in fs/btrfs/raid56.c.
Read full articleMounting a crafted btrfs image, performing some operations, and unmounting leads to a use-after-free in btrfs_queue_work in fs/btrfs/async-thread.c.
Read full articleMounting a crafted btrfs image twice causes an rwsem_down_write_slowpath use-after-free because rwsem_owner_flags returns an already freed task_struct pointer.
Read full articleA setxattr operation after mounting a crafted ext4 image causes a slab-out-of-bounds write in ext4_xattr_set_entry because a large old_size value is used in a memset call.
Read full article__btrfs_free_extent in fs/btrfs/extent-tree.c calls btrfs_print_leaf in a certain ENOENT case, leaking potentially sensitive register values to local users through dmesg.
Read full articleext4_empty_dir in fs/ext4/namei.c allows a NULL pointer dereference because ext4_read_dirblock(inode,0,DIRENT_HTREE) can return zero after a crafted ext4 image is mounted.
Read full articlebtrfs_root_node in fs/btrfs/ctree.c allows a NULL pointer dereference because rcu_dereference(root->node) can return zero when a crafted btrfs image is mounted.
Read full articleA crafted btrfs image triggers a NULL pointer dereference in btrfs_verify_dev_extents because fs_devices->devices is mishandled inside find_device (fs/btrfs/volumes.c) in Linux kernels before 5.1.
Read full articleA retrospective on my time in Best of the Best (BoB) Cohort 8 — building a filesystem fuzzer, finding 16 CVEs, and speaking at CodeBlue and HITB
Read full article