Skip to content
Chrome OS exploit: one byte overflow and symlinks
projectzero.google | blog | #privilege-escalation | #exploit | #guest-post | #symlink | #project-zero | #chrome-os | #one-byte-overflow
Summary
A guest post detailing a Chrome OS exploit that combines a one-byte overflow with symlink tricks to escalate privileges, written by an external researcher.
- Published
- Collected
Related coverage
blog ·
projectzero.google
Exploiting the DRAM rowhammer bug to gain kernel privileges
A Google Project Zero write-up demonstrating how the DRAM rowhammer hardware flaw can be exploited from an unprivileged process to gain kernel privileges.
blog ·
projectzero.google
More Mac OS X and iPhone sandbox escapes and kernel bugs
A Google Project Zero rundown of sandbox escape and privilege escalation bugs in Mac OS X and iOS fixed by Apple in OS X 10.9.5 and iOS 8.
research ·
projectzero.google
Finding and exploiting ntpd vulnerabilities
A Google Project Zero guest post telling how one of the researchers found and exploited vulnerabilities in the ntpd network time server.
blog ·
projectzero.google
A 0-click exploit chain for the Pixel 9 Part 2: Cracking the Sandbox with a Big Wave
Second part of Project Zero's Pixel 9 zero-click chain research: auditing the BigWave AV1 decoder driver reachable from the mediacodec sandbox and finding bugs that yield kernel read and write.
blog ·
projectzero.google
Windows Exploitation Techniques: Winning Race Conditions with Path Lookups
A Windows exploitation technique post showing how path lookup behavior can be leveraged to reliably win race conditions, with worked examples and exploitation implications.
blog ·
projectzero.google
Zooming in on Zero-click Exploits
.post-body{ul.lst-kix_ef7dug197aaw-4{list-style-type:none}ul.lst-kix_ef7dug197aaw-3{list-style-type:none}.lst-kix_ef7dug197aaw-0>li:before{content:"- "}ul.lst-kix_ef7dug197aaw-2{list-style-type:none}ul.lst-kix_ef7dug197aaw-1{list-style-type:none}.lst-kix_ef7dug197aaw-1>li:before{content:"- "}ul.lst-kix_ef7dug197aaw-8{list-style-type:none}ul.lst-kix_ef7dug197aaw-7{list-style-type:none}ul.lst-kix_ef7dug197aaw-6{list-style-type:none}ul.lst-kix_ef7dug197aaw-5{list-style-type:none}ul.lst-kix_ef7dug197aaw-0{list-style-type:none}.lst-kix_ef7dug197aaw-7>li:before{content:"- "}.lst-kix_ef7dug197aaw-6>li:before{content:"- "}.lst-kix_ef7dug197aaw-8>li:before{content:"- "}.lst-kix_ef7dug197aaw-5>li:before{content:"- "}.lst-kix_ef7dug197aaw-3>li:before{content:"- "}.lst-kix_ef7dug197aaw-2>li:before{content:"- "}.lst-kix_ef7dug197aaw-4>li:before{content:"- "}ol{margin:0;padding:0}table td,table th{padding:0}.c7{background-color:#ffffff;color:#222222;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c18{background-color:#ffffff;padding-top:0pt;padding-bottom:0pt;line-height:1.2222222222222223;orphans:2;widows:2;text-align:left}.c10{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:16pt;font-family:"Arial";font-style:normal}.c13{padding-top:18pt;padding-bottom:6pt;line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.c2{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Arial";font-style:normal}.c14{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:13.5pt;font-family:"Arial";font-style:normal}.c0{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left;height:11pt}.c3{color:#000000;font-weight:400;text-decoration:none;vertical-align:baseline;font-size:11pt;font-family:"Courier New";font-style:normal}.c15{color:#000000;font-weight:700;text-decoration:none;vertical-align:baseline;font-size:13.5pt;font-family:"Arial";font-style:normal}.c1{padding-top:0pt;padding-bottom:0pt;line-height:1.5;orphans:2;widows:2;text-align:left}.c17{text-decoration-skip-ink:none;-webkit-text-decoration-skip:none;color:#1155cc;text-decoration:underline}.c9{padding-top:0pt;padding-bottom:0pt;line-height:1.0;text-align:left}.c16{background-color:#ffffff;max-width:468pt;padding:72pt 72pt 72pt 72pt}.c6{font-weight:400;font-family:"Courier New"}.c8{color:inherit;text-decoration:inherit}.c4{border:1px solid black;margin:5px}.c21{font-size:13.5pt;font-weight:700}.c11{background-color:#ffffff;color:#222222}.c20{background-color:#ffffff}.c19{margin-left:36pt}.c12{height:11pt}.c5{text-indent:36pt}.title{padding-top:0pt;color:#000000;font-size:26pt;padding-bottom:3pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}.subtitle{padding-top:0pt;color:#666666;font-size:15pt;padding-bottom:16pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}li{color:#000000;font-size:11pt;font-family:"Arial"}p{margin:0;color:#000000;font-size:11pt;font-family:"Arial"}h1{padding-top:20pt;color:#000000;font-size:20pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h2{padding-top:18pt;color:#000000;font-size:16pt;padding-bottom:6pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h3{padding-top:16pt;color:#434343;font-size:14pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h4{padding-top:14pt;color:#666666;font-size:12pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h5{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;orphans:2;widows:2;text-align:left}h6{padding-top:12pt;color:#666666;font-size:11pt;padding-bottom:4pt;font-family:"Arial";line-height:1.5;page-break-after:avoid;font-style:italic;orphans:2;widows:2;text-align:left}} Posted by Natalie Silvanovich, Project Zero