Classic Vulnerabilities
summary
Examines decades-old, concrete exploits: an unlink heap primitive is reproduced against Chocolate Doom and a proof-of-concept merged to Chocolate Doom as a patch, demonstrating how corrupted malloc metadata yields a write-what-where. Covers kernel-level BadBinder CVE‑2019 (used by NSO/Pegasus) where a use‑after‑free becomes an arbitrary kernel R/W primitive, found via syscall grammar fuzzing (ciscollar). Shows integer-overflow cases (Chrome 2017, Apple CVE‑2021‑3860) and a printf SSID format-string crash on iOS, and recommends use AddressSanitizer + libFuzzer and integer sanitizer / clang-tidy to find these bugs.
AI-written summary · about
chapters (8)
- 0:00Start
- 5:03Doug Lea's malloc
- 6:46Chocolate-Doom
- 8:52Z_Malloc
- 13:40Insight
- 15:27Proof of Concept
- 30:07How to exploit
- 46:51How to find them
related talks
01h 05mClassic Vulnerabilities
51mExploiting Hardware Glitches And Side Channels In Perfect Software
39mNight of the living vulnerabilities
01h 00m“Secure Coding Best Practices: Your First Line Is The Last Line Of Defense (1 of 2)”
47mExploring the New World : Remote Exploitation of SQLite and Curl
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
39mInsecure Containers? Continuous Defense Against Open Source Exploits