PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2023-21674] Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)

theori.io | vulnerability | CVE-2023-21674 | #use-after-free | #sandbox-escape | #windows-kernel | #cve-2023-21674 | #alpc | #chrome-sandbox
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of the chain: how CVE-2023-21674, a use-after-free in the Windows NT kernel involving ALPC, was exploited to escape the Chrome sandbox — the year’s first in-the-wild kernel bug.
CVE
CVE-2023-21674
Published
Collected

Related coverage

Critical · vulnerability · theori.io
Finding and Patching a CPython 0day in Hours: CVE-2026-6100
CVE-2026-6100 timeline: Xint Code flagged a critical CPython tarfile flaw within 30 minutes, and Python maintainers patched three compression modules the day after the report.
vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 6 — Windows Kernel LPE: Get SYSTEM
Final part of the N-day chain series: how CVE-2023-36802, a type-confusion flaw in the mskssrv.sys driver, was analysed and exploited to raise VMware privileges to SYSTEM on the host.
vulnerability · theori.io
Exploiting Windows Kernel Wild Copy With User Fault Handling (CVE-2023–28218)
How Theori found and reliably exploited CVE-2023-28218, a heap overflow in Windows' afd.sys Fast I/O path, turning wild copy with user fault handling into a kernel exploit, detailed at Hexacon 2023.
vulnerability · theori.io
Linux Kernel Exploit (CVE-2022–32250) with mqueue
Exploiting CVE-2022-32250, a Netfilter nftables use-after-free write, to root Ubuntu 22.04: heap and KASLR leaks with mqueue, a modprobe_path overwrite, plus root-cause analysis and patch.
High · vulnerability · blog.quarkslab.com
PageJack in Action: CVE-2022-0995 exploit
Quarkslab applies PageJack, a 2024 page-allocator exploitation technique, to CVE-2022-0995 — an out-of-bounds write in the Linux kernel's watch_queue affecting 5.17+ — with a full working exploit.
Back