232 - RetSpill, A Safari Vuln, and Steam RCE [Binary Exploitation Podcast]

A bit of a rambling episode to finish off 2023, we talk about some Linux kernel exploitation research (RetSpill) then get into several vulnerabilities. A type confusion in QNAP QTS5, a JavaScriptCore bug in Safari, and several issues in Steam's Remote Play protocol.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/232.html

[00:00:00] Introduction
[00:02:00] RetSpill - Igniting User-Controlled Data to Burn Away Linux Kernel Protections
[00:12:23] QNAP QTS5 – /usr/lib/libqcloud.so JSON parsing leads to RCE
[00:19:53] Safari, …

binary binary exploitation bug exploitation introduction kernel linux linux kernel play podcast protocol qnap rce research safari steam type confusion vuln vulnerabilities