Buggy Browsers, Heap Grooming, and Broken RSA?

This week we get to take a look into some basic heap grooming techniques as we examine multiple heap overflows. We also briefly discuss the hand-on (by the DoD and Synack) assessment of the "unhackable" morpheus chip, and briefly discuss the new-ish paper claiming to defeat RSA. [00:00:53] "This destroys the RSA cryptosystem." - Fast Factoring Integers by SVP Algorithms https://eprint.iacr.org/2021/232https://github.com/lducas/SchnorrGate [00:06:55] DARPA pitted 500+ hackers against this computer chip. The chip won. https://cse.engin.umich.edu/stories/morpheus-vs-everybodyhttps://www.reddit.com/r/HowToHack/comments/bl9qo3/morpheus_chip/empsclt/?context=10 [00:18:10] SaltStack API vulnerabilities https://dozer.nz/posts/saltapi-vulnshttps://github.com/saltstack/salt/blob/08fe46365f92583ea875f9e4a8b2cb5305b34e4b/salt/client/ssh/client.py#L72 [00:22:57] An Interesting Feature in the Samsung DSP Driver https://www.synacktiv.com/en/publications/an-interesting-feature-in-the-samsung-dsp-driver.html [00:30:50] Pre-Auth Remote Code Execution in VMware ESXi [CVE-2020-3992 CVE-2021-21974] https://www.thezdi.com/blog/2021/3/1/cve-2020-3992-amp-cve-2021-21974-pre-auth-remote-code-execution-in-vmware-esxi [00:39:05] Defeating the TP-Link AC1750 https://www.synacktiv.com/en/publications/pwn2own-tokyo-2020-defeating-the-tp-link-ac1750.html [00:44:52] Anatomy of an Exploit: RCE with CVE-2020-1350 SIGRed https://www.graplsecurity.com/post/anatomy-of-an-exploit-rce-with-cve-2020-1350-sigred [00:57:11] Yet another RenderFrameHostImpl UAF https://microsoftedge.github.io/edgevr/posts/yet-another-uaf/ [01:03:16] Webkit AudioSourceProviderGStreamer use-after-free vulnerability https://talosintelligence.com/vulnerability_reports/TALOS-2020-1172 Watch the DAY[0] podcast live on Twitch (@dayzerosec) every Monday afternoon at 12:00pm PST (3:00pm EST) Or the video archive on Youtube (@dayzerosec)