6
edits
Changes
Jump to navigation
Jump to search
Line 93:
Line 93: + + + + + +
Added IOSU message queue exploit
| [[User:Plutoo|plutoo]] (on September 11th, 2015);
| [[User:Plutoo|plutoo]] (on September 11th, 2015);
Mrrraou (independently, on October 31th, 2016)
Mrrraou (independently, on October 31th, 2016)
|-
| IOS_CreateMessageQueue poor address range validation
| IOS_CreateMessageQueue() syscall does not check the number of entries, allowing for an integer overflow that will bypass the address range validation. Using IOS_SendMessage(), one can overwrite IOSU kernel and achieve code execution. see [https://www.youtube.com/watch?v=8C5cn_Qj0G8 here] and [https://github.com/Rambo6Glaz/iosu_mq_exploit/blob/master/source/main.c here] for impl.
| ARM kernel code execution
| None
| [[User:derrek|derrek]], [[User:nedwill|nedwill]] and [[User:naehrwert|naehrwert]] ?
|}
|}