218 - A Chrome RCE, WebP 0day, and glibc LPE [Binary Exploitation Podcast]

Some complex and confusing vulnerabilities as we talk about the recent WebP 0day and the complexities of huffman coding. A data-only exploit to escape a kCTF container, the glibc LPE LOONY_TUNABLES, and a Chrome TurboFan RCE.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/218.html

[00:00:00] Introduction
[00:00:40] Expanding our exploit reward program to Chrome and Cloud
[00:06:10] The WebP 0day
[00:34:00] Escaping the Google kCTF Container with a Data-Only Exploit
[00:44:49] Local Privilege Escalation in the glibc's …

0day binary binary exploitation chrome coding container data escape exploit exploitation glibc introduction lpe podcast program rce reward vulnerabilities webp