Classic Vulnerabilities
summary
A 2000-era unlink heap exploit (Solar Designer) is reproduced against Chocolate Doom: crafted heap metadata corruption creates a write-what-where when freed, a proof-of-concept exploit and unit test are built and a pointer-check patch is merged, demonstrating a real fix that stops the primitive. The same pattern appears in 2019’s BadBinder chain that yields arbitrary kernel read/write and in later CVEs (Chrome 2017, Apple 2021). Modern detection relies on AddressSanitizer + fuzzing and sanitizers (UBSan/integer sanitizer) to find these classic bugs.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 0:28Living in the future
- 1:05Systems programming vs binary exploitation
- 2:18Patricia Aas
- 4:12Back in time
- 5:15Back in 2000
- 7:37Example
- 12:03Memory Allocation
- 13:01Free Function
- 13:40Typical Unlinking
- 14:49Basic Insight
- 23:37Bad Binder
- 24:54Android IPC
- 27:12Googles Response
- 29:21Config Debug List
- 30:11Use After Free
- 31:23Overwrite Address Limits
- 31:53Address Sanitizer
- 35:44Frack Magazine
- 36:36Undefined Behavior
- 41:08CV 201716
- 41:20CV 201717
- 41:31CV 201718
- 42:19CV 2021
- 44:48CV 2010 Code
- 45:31Format Streams 2010
- 51:32Apple iOS 2021
- 52:38Compilers
- 54:53Crosspollination
- 57:10Heap Overflow
related talks
01h 16mClassic Vulnerabilities
51mExploiting Hardware Glitches And Side Channels In Perfect Software
41mThinking Outside the Sandbox - Violating Trust Boundaries in Uncommon Ways
01h 00mIntroduction to memory exploitation
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
49m$Hell on Earth: From Browser to System Compromise
35mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
51mThe Anatomy of an Exploit