Post: [Rumour]Naehwert's Exploiting lv2?!
09-22-2012, 06:41 AM #1
(adsbygoogle = window.adsbygoogle || []).push({}); You must login or register to view this content.
You must login or register to view this content. is always active, this guy don’t stop (lucky for him) Now with this:

To quote:
---------------------------------------------------------------------------------------------
A long while ago KaKaRoTo pointed me to a stack overflow he found while reversing lv2_kernel. But there are two problems:

The vulnerability is in a protected syscall (the SELF calling it got to have the 040 control flags set). So youd first need to find a suitable usermode exploit (dont ask us), that gives you code execution with the right privileges.
The payload data is copied to lv2 heap first and the function will do a free call on it before the payload has any chance to get executed. This might not sound like a problem but it looks like lv2′s heap implementation will overwrite the freeed space with 0xABADCAFE and thus destroy the payload.

Here is my sample implementation for 3.41 lv2_kernel (although the vulnerability should be present in all versions of lv2 up to the latest firmware), maybe someone of you will find a way to overcome problem (2.) and can get something nice out of it because right now its only good to crash lv2.
---------------------------------------------------------------------------------------------
Source: Naehrwert's WordPress You must login or register to view this content.
Thanks to @H3avyRa1n
(adsbygoogle = window.adsbygoogle || []).push({});

Copyright © 2026, NextGenUpdate.
All Rights Reserved.

Gray NextGenUpdate Logo