CVE-2022-25664 is one of the most interesting bug I've reported. It's "only" an info leak, but a very powerful one that allows an untrusted Android app to read pages of memory from the kernel or other apps any number of times.
117
365
Follow
Man Yue Mo
@mmolgtm
Security researcher at GitHub Security Lab. Tweets/views/opinions are my own.
Joined September 2017
Man Yue Mo’s Tweets
It may seem fair that Android "can't fix" this bug as it's in 3rd party code, but even after Arm released a public patch, it look 3 months for Android to apply the patch. Sadly, this is not a one off, as the list goes on: github.blog/2023-01-23-pwn IMO this is worse than having 0day
2
17
39
Show this thread
In this post I'll use CVE-2022-38181, a use-after-free I reported last year in the Arm Mali GPU driver to gain arbitrary kernel code execution and root from untrusted Android app. Not sure if the bug or the disclosure is more interesting:
2
143
374
Show this thread
file: "mali_app/app/src/main/cpp/hello-jni.c": 4b66a16931b96fdf14a32aa9963c25326a2a8b217e7a842d886d5885ef01956d
The email I sent: 234646839712e54fb7179ab74ddeb6bb8857d9bd853b29be2596fdb21d22a4c7 (Plain text starts from "Hi" and ends with "Mo") Thanks!
3
Show this thread
Bug trigger: 1. file with "main", shorter file name: b50887cdcd53c2d63ea8253bae534aa079f99aac93fa5ff900c34f9475cb4086
2. file with "main", longer file name: c20576e4895e6d4ddd1b40eb05375d274b2788867d0aa921699b9dddd945732a
1
1
3
Show this thread
If someone from security is reading this, please reply to my email on 5 Aug about a bug report that Android security team shared with you privately, thanks. SHA256 of various files for verification (next tweets)
3
12
25
Show this thread
This might be the best bug I found. Never thought I'd be writing a kernel exploit as reliable, clean and fast as a browser exploit. For a while I actually used this to root my research phone when can't be bothered to patch the rom:
7
127
389
In this post goes through the details of CVE-2022-1134, a type confusion in Chrome, and shows how to gain remote code execution in the Chrome renderer using this bug.
1
93
189
This is probably the most complex exploit I've done so far. A UAF in Android kernel freed by kfree_rcu (introduces a delay) in a tight race + kCFI + Samsung RKP. Yet its still possible to gain arbitrary kernel RW, disable SE and root from untrusted app.
4
166
519
In this post I'll go through 3 bugs in the Qualcomm NPU driver that I reported, which allowed me to execute arbitrary kernel code from the untrusted app domain in Android, disable SELinux and bypass task cred protection to gain root on a Samsung phone:
5
105
318
Go dumpster diving for arbitrary code execution in v8's garbage collector with in his Chrome vulnerability RCA for CVE-2021-37975 github.co/3pjp3RY
103
226
Learn how dug his way out of the Chrome sandbox using a credit card as a shovel! "The fugitive in Java: Escaping to Java to escape the Chrome sandbox" github.co/3AY6Uw6
1
39
82
Curious how the recently patched Chrome 0days (CVE-2021-30632, CVE-2021-30633) affected you? explores the fascinating intricacies of exploiting optimized property access based type confusions in Chrome's v8 JIT github.co/39GLJT7
2
82
193
Dive into the exploitation of a Chrome WebAudio UAF in this third and final installment of 's Full Chain series github.co/31eUS15
54
134
In the last part of the Chrome beta + Android full chain series, I'll use a Chrome WebAudio UAF I reported last September (which turned out to be a bug collision) to gain RCE in the renderer sandbox.
1
28
89
Learn how tiny shovels can dig big holes in the second installment of 's full chain series: One day short of a full chain: Part 2 - Chrome sandbox escape github.co/3bWOl1n
16
32
In this second part of the Chrome beta + Android full chain series, I'll use a sandbox escape in the beta version of Chrome v86 that I reported last September to gain App privilege from the Chrome renderer sandbox:
1
76
165
If you’re out of popcorn you’re in luck because popped some fresh Android kernels for you to enjoy! "One day short of a full chain: Part 1 - Android Kernel arbitrary code execution" github.co/2On97xT
36
78
In this series of posts I'll exploit 3 bugs that I reported last year. Together they can form a full chain from Chrome beta v86 to the Android kernel. The first post is about exploiting a UAF in the kernel reachable from the App sandbox:
2
135
357
In this post I'll go through the exploit of CVE-2020-6449, a use-after-free in blink that I found in March, and break PartitionAlloc in the process:
7
48
123
Curious how managed to actually exploit that Chrome WebAudio Use After Free he found back in March? 🎃 Mo shares his tricks and treats us with his latest post on Chrome UAF exploitation 👻 github.co/3msMoMy
29
100
In this post I give details about how to create an exploit for the type confusion vulnerability (CVE-2018-19134) of Ghostscript and turn it into a RCE. I have to say PostScript is not my prefer language for writing exploit. lgtm.com/blog/ghostscri
91
212
This post gives the details of some type confusions (CVE-2018-19134,19475-76) that I found in Ghostscript after studying reports of similar issues filed by between 2016 and 2018. The tools used for finding these bugs are open sourced. lgtm.com/blog/ghostscri
1
37
90
This post contains the details of a sandbox escape bug in Ghostscript that I found a couple of months ago that is a variant of the ones that discovered last August. lgtm.com/blog/ghostscri
68
133
Done some variant analysis with the Ghostscript RCEs that found in the last few months and ended up finding another -dSAFER bypass RCE, plus some type confusions, one of which is also a proper RCE. All patched in 9.26. Write ups coming soon.
3
41
76
This post reviews OGNL mitigation measures in Struts and how they were bypassed in the past, leading up to a CVE-2018-11776 exploit that actually works. lgtm.com/blog/apache_st
67
111
Patch Apple devices and avoid public wifi! discovered a kernel heap overflow that can be triggered by someone sharing the same network as you, affecting all devices by default without user interaction. lgtm.com/blog/apple_xnu
5
In this post on Struts' OGNL injection vulnerabilities I'll go through a type of RCE issue called "double evaluation". There are a number of new issues, although no CVE as Struts did not think it's their responsibility. lgtm.com/blog/apache_st
68
116
In this second post on Struts' ognl injection vulnerabilities I'll give an overview of the structure of Struts and a more detailed dataflow analysis of CVE-2018-11776.
lgtm.com/blog/apache_st
48
65
For people looking into intrusion detection of CVE-2018-11776. From what is available in public, it should be clear that the attack is done via a url with ognl. So look for url that contains ognl. An exploit won't tell you more than that.
4
13
Struts users should take the advice of the Struts team to upgrade:
cwiki.apache.org/confluence/dis
the new versions are backward compatible and they don't just patched CVE-2018-11776 but also include general security improvements to make life harder for hackers.
1
4
9
As some people have asked about exploits of CVE-2018-11776. I don't plan to release it at the moment so that users can have time to upgrade, I would also like to urge others to refrain from releasing exploits just yet.
2
3
9
I'm writing some blogs that study RCEs in #apachestruts. I'll start with the latest CVE-2018-11776 that I found and how they are related to some previously known RCEs. lgtm.com/blog/apache_st
1
126
219
A few weeks ago, wrote in #ZDI about an incomplete auth bypass fix that turned post auth EL injections such as ZDI-17-663 of into RCE. Here is another EL injection in Spring that also has an interesting fix/patch story: lgtm.com/blog/spring_da
7
14
Interested in how we approach security research and disclosing #0days? We now have a page detailing our official vulnerability disclosure policy, and detailing how we use QL to discover them in the first place: lgtm.com/security #vulnerabilities #SecurityResearch
5
3
We review some #javadeser vulnerabilities in Android and showed how to find them using QL, these include CVE-2014-7911(), CVE-2015-3825 ( and ), CVE-2017-411/412() and a new one CVE-2017-0871: lgtm.com/blog/android_d
1
40
59
Thanks to the hard work of the Java team, (Anders Schack-Mulligen in particular), the 'Deserialization of user-controlled data' query in lgtm.com now catches Struts' CVE-2017-9805 with great precision!
2
1