nicolas vamous
585
posts
@NVamous
Joined June 2020
Finally finish the talk "Game of Cross Cache: Let's Win It in a More Effective Way!", trying to solve challenges in cross-cache attack. Here are slides:
Looking forward to...
#BHASIA Briefing "Game of Cross Cache: Let's Win It in a More Effective Way!" will provide a detailed discussion on how to use Dirty Pagetable[1], an effective cross-cache-based exploit method, to achieve privilege escalation on a Samsung Mobile device >> bit.ly/4chsM8D
👍 Leaking physical base address is not necessary if we construct AARW by controlling the page of pipe buffer or other kernel objects.
Finally, the slides release: i.blackhat.com/EU-23/Presenta… We succeeded in performing arbitrary code execution in Samsung NPU firmware with CVE-2023-42483. Moreover, we got ROOT on another Qualcomm device with CVE-2023-33114.
@VAR10CK🫡
