346
edits
Changes
Jump to navigation
Jump to search
mLine 72:
Line 72: + + + + + + + Line 108:
Line 115: − |- − | ioctlvhax (ioctlv TOCTOU) − | This flaw technically is in the kernel, but it can be used to exploit a userland module. − It allows changing an ioctlv vector buffer address entry after it has been validated by the kernel. Any module not checking the number of ioctlv vectors is vulnerable. More information [https://nwert.wordpress.com/2016/05/03/ioctlvhax/ here]. − | ROP under several IOSU modules − | 5.2.0 − | [[User:Naehrwert|naehrwert]] and [[User:Plutoo|plutoo]]
→ARM software (IOSU): moved ioctlvhax to kernel
! Fixed in system version
! Fixed in system version
! Discovered by
! Discovered by
|-
| ioctlvhax (ioctlv TOCTOU)
| This flaw technically is in the kernel, but it can be used to exploit a userland module.
It allows changing an ioctlv vector buffer address entry after it has been validated by the kernel. Any module not checking the number of ioctlv vectors is vulnerable. More information [https://nwert.wordpress.com/2016/05/03/ioctlvhax/ here].
| ROP under several IOSU modules
| 5.2.0
| [[User:Naehrwert|naehrwert]] and [[User:Plutoo|plutoo]]
|-
|-
| Bad memset in IOS_CreateThread syscall
| Bad memset in IOS_CreateThread syscall
! Fixed in system version
! Fixed in system version
! Discovered by
! Discovered by
|-
|-
| uhshax (/dev/uhs/0 bad array index check)
| uhshax (/dev/uhs/0 bad array index check)