BitUnmap: Attacking Android Ashmem

A Google Project Zero essay on what makes a memory corruption vulnerability valuable, focusing on how reliably it can be exploited.

A Google Project Zero post on a 'wild copy' parallel thread memory corruption bug and its exploitation.

A Google Project Zero post revisiting the classic poisoned NUL byte bug and what a single NUL write can achieve on modern systems.

This blog post discusses a bug leading to memory corruption in Samsung's Android kernel (specifically the kernel of the Galaxy A50, A505FN - I haven't looked at Samsung's kernels for other devices). I will describe the bug and how I wrote a (very unreliable) exploit for it. I will also describe how a second vulnerability, which had long been fixed in the upstream kernel, the upstream stable releases, and the Android common kernel, but not in Samsung's kernel, aided in its exploitation.

Amid confusion over the remote exploitability of Android libstagefright vulnerabilities, this post demonstrates a working exploit for one of them on recent Android versions, Android 5.0+ on Nexus 5.

A Google Project Zero write-up analyzing and exploiting a vulnerability in ESET antivirus software, highlighting the attack surface introduced by security products.