[binary] Attacking VirtualBox and Malicious Chess

Day[0]

Content provided by dayzerosec. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by dayzerosec or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

1y ago 50:40

MP3•Episode home

This week we we've got a neat little printer corruption, a probably unexploitable stockfish bug, though we speculate about exploitation a bit. Then into a VirtualBox escape bug, and an Andreno "vulnerability".

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/212.html

[00:00:00] Introduction

[00:01:31] Spot the Vuln - To Upload or Not To Upload

[00:05:25] The printer goes brrrrr, again!

[00:09:34] [Stockfish] Increase MAX_MOVES to prevent buffer overflow and stack corruption

[00:27:53] Analysis of VirtualBox CVE-2023-21987 and CVE-2023-21991

[00:37:09] Qualcomm Adreno/KGSL: secure buffers are addressable by all GPU users

[00:43:37] RET2ASLR - Leaking ASLR from return instructions

[00:46:13] Apple Fails to Fully Reboot iOS Simulator Copyright Case

The DAY[0] Podcast episodes are streamed live on Twitch twice a week:

-- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities

-- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.

We are also available on the usual podcast platforms:

-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

-- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9

254 episodes

#Tech #dayzerosec