311
edits
Changes
Jump to navigation
Jump to search
no edit summary
Line 27:
Line 27:
==boot1==
==boot1==
+{| class="wikitable" border="1"
+! Summary
+! Description
+! Successful exploitation result
+! Fixed in system version
+! Discovered by
+|-
+| boot1hax (unsafe "boot_info" pointer)
+| boot1 communicates with IOS-MCP using the "boot_info" structure. A pointer to this structure is stored in the PRSH/PRST section in MEM2 which is given back to boot1 on a warmboot.
+Due to this pointer not being validated by boot1, an attacker can craft a malicious PRSH/PRST section where the "boot_info" pointer will point to anywhere inside boot1's memory region and thus achieving a semi-arbitrary write.
+| boot1 code execution
+| None
+| derrek, [[User:Plutoo|plutoo]], [[User:Naehrwert|naehrwert]], [[User:Yellows8|yellows8]], [[User:Shuffle2|shuffle2]] and [[User:Hexkyz|hexkyz]]
+|}
==ARM software (IOSU)==
==ARM software (IOSU)==