111
edits
Changes
Jump to navigation
Jump to search
Line 139:
Line 139: + + + + + +
Add udpih
| None
| None
| [[User:GaryOderNichts|GaryOderNichts]], [[User:Yellows8|yellows8]] (independently: January 2021)
| [[User:GaryOderNichts|GaryOderNichts]], [[User:Yellows8|yellows8]] (independently: January 2021)
|-
| Out of bounds byteswap during USB configuration parsing
| The Wii U doesn't verify the total length of the USB configuration descriptor. This allows placing endpoint descriptors outside of the allocated buffer which will be swapped.
| Out of bounds byteswap in IOS-USB heap. Can lead to ROP, see [https://garyodernichts.blogspot.com/2022/06/exploiting-wii-us-usb-descriptor-parsing.html this post].
| None
| [[User:GaryOderNichts|GaryOderNichts]]
|}
|}