196 - An OpenBSD overflow and TPM bugs [Binary Exploitation Podcast]

Some simple, but interesting vulnerabilities. A use-after-free because of wrong operation ordering, an interesting type confusion, an integer underflow and some OOB access in TPM 2.0 reference code.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/196.html

[00:00:00] Introduction
[00:00:27] Spot the Vuln - Just be Positive
[00:03:42] oss-sec: Linux kernel: CVE-2023-1118: UAF vulnerabilities in "drivers/media/rc" directory
[00:07:56] oss-sec: CVE-2023-1076: Linux Kernel: Type Confusion hardcodes tuntap socket UID to root
[00:11:21] GitHub - fuzzingrf/openbsd_tcpip_overflow: OpenBSD remote overflow
[00:14:36] …

access binary binary exploitation bugs code cve directory drivers exploitation free github integer introduction kernel linux linux kernel media oob openbsd oss overflow podcast reference root sec simple socket tpm tpm 2.0 type confusion uaf use-after-free vuln vulnerabilities