The OffensiveCon23 talk recordings are up on YouTube, and the line-up is the usual dose of deep exploitation work.
Highlights include Ian Beer on MacDirtyCow and XNU virtual memory, Maddie Stone and James Forshaw on the Print Spooler bug that wasn’t in the Print Spooler, Moshe Kol racing a spinlock use-after-free in the Android kernel, and Amat Cama exploiting ASN.1 parsers in basebands.
MacDirtyCow is CVE-2022-46689, and back in December zhuowei turned Apple’s own XNU test case into a root PoC that writes to a read-only file mapping to defang /etc/pam.d/su.
Samuel Groß and Carl Smith on JavaScript engine fuzzing and Yarden Shafir on turning mitigations into opportunities round it off.
If you prefer reading to watching, Thomas Chauchefoin of Sonar wrote up his picks from the roughly 450-attendee conference in Berlin, including Thomas Roth’s Lightning cable work and his open-source Tamarin Cable firmware.
Clear your weekend; there is no TL;DR for kernel exploitation.
