Full Chain Baseband Exploits, Part 2

Additional posts in this series:
Part 1 Part 3 If you’ve watched my Basebanheimer talk, you will have noticed that concrete ideas for exploiting CVE-2022-21744, a heap buffer overflow in Mediatek baseband, were omitted from the talk for brevity.
This heap overflow vulnerability has an important limitation: the overwriting value is a pointer to an allocation with attacker controlled bytes.
In other words, as explained in the talk, we aren’t controlling the bytes we corrupt with directly, we write 4 …

baseband buffer buffer overflow concrete cve exploiting exploits heap buffer overflow ideas important mediatek overflow posts series the talk value vulnerability