PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

From virtio-snd 0-day to hypervisor escape: exploiting QEMU with an uncontrolled heap overflow

osec.io | research | #zero-day | #exploit | #heap-overflow | #qemu | #glibc | #virtio | #hypervisor-escape
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

OtterSec turns an uncontrolled heap overflow in QEMU's virtio-snd 0-day into a reliable guest-to-host escape using new glibc allocator behavior and QEMU-specific heap sprays.
Published
Collected

Related coverage

vulnerability · horizon3.ai
[CVE-2023-26067] Lexmark Command Injection Vulnerability ZDI-CAN-19470 Pwn2Own Toronto 2022
In December 2022, we competed at our first pwn2own. We were able to successfully exploit the Lexmark MC3224i using a command injection 0-day.
vulnerability · volexity.com
DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach
Volexity frequently works with individuals and organizations heavily targeted by sophisticated, motivated, and well-equipped threat actors from around the world. Some of these individuals or organizations are attacked infrequently or […]
research · osec.io
Pwning Minecraft: 4-byte heap overflow to RCE
OtterSec achieves RCE in Minecraft Bedrock, turning a 4-byte heap overflow from a malicious server into full client compromise on Windows, bypassing ASLR and Control Flow Guard.
research · swarm.ptsecurity.com
Hack the Elephant One Bite at a Time: JPEG-Related Memory-Safety Bugs in PHP
PT SWARM audited PHP's ext/standard C code and found memory-safety bugs: a heap memory disclosure in getimagesize() and a heap buffer overflow in iptcembed(), both reachable via crafted JPEGs.
research · depthfirst.com
NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
depthfirst's system found four remote memory-corruption bugs in NGINX, including a 2008-era heap overflow (CVE-2026-42945); a PoC shows RCE with ASLR off. rewrite/set users are at risk.
research · blog.quarkslab.com
Linux kernel instrumentation from Qemu and Gdb
A tutorial on instrumenting the Linux kernel from QEMU and GDB: using a hypervisor for stealthy analysis, plus GDB scripting and kernel helper tools to monitor syscalls, processes and modules.
Back