ESP32 Glitches

Some simple, but interesting vulnerabilities. A use-after-free because of wrong operation ordering, an interesting type confusion, an integer underflow and some OOB access in TPM 2.0 reference code.

Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/196.html

[00:00:00] Introduction

[00:00:27] Spot the Vuln - Just be Positive

[00:03:42] oss-sec: Linux kernel: CVE-2023-1118: UAF vulnerabilities in "drivers/media/rc" directory

[00:07:56] oss-sec: CVE-2023-1076: Linux Kernel: Type Confusion hardcodes tuntap socket UID to root

[00:11:21] GitHub - fuzzingrf/openbsd_tcpip_overflow: OpenBSD remote overflow

[00:14:36] Chat Question: What Language is Most Effective for Writing These Types of Exploits

[00:18:22] Vulnerabilities in the TPM 2.0 reference implementation code

[00:28:19] Chat Question: Skillset for Exploit Dev as part of a Red Team

[00:33:40] Espressif ESP32: Glitching The OTP Data Transfer

The DAY[0] Podcast episodes are streamed live on Twitch twice a week:

 -- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities

 -- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities  and exploits.

We are also available on the usual podcast platforms:

 -- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063

 -- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt

 -- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz

 -- Other audio platforms can be found at https://anchor.fm/dayzerosec

You can also join our discord: https://discord.gg/daTxTK9