Pwn@Home An Attack Path to jailbreaking your home router

Recommendations

Info

Set-top-box Router Firmware Chroot escape CVE-2011-1352: Privilege escalation in PowerVR SGX if (CopyToUserWrapper(psPerProc, ui32BridgeID, psBridgePackageKM->pvParamOut, psBridgeOut, psBridgePackageKM->ui32OutBufferSize) != PVRSRV_OK) { goto return_fault; } [...] if (CopyFromUserWrapper(psPerProc, ui32BridgeID, psBridgeIn, psBridgePackageKM->pvParamIn, psBridgePackageKM->ui32InBufferSize) != PVRSRV_OK) { goto return_fault; }
Set-top-box Router Firmware Chroot escape Levitator http://jon.oberheide.org/files/levitator.c Read and write access to a fixed address in the heap Size under attacker control Android: dev_attr_ro function pointers hijacking
Page 1 and 2: Pwn@Home An Attack Path to jailbrea
Page 3 and 4: Set-top-box Router Firmware Context
Page 5 and 6: Set-top-box Router Firmware Targets
Page 7 and 8: Set-top-box Router Firmware Plan 1
Page 9: Set-top-box Router Firmware Code ex
Page 12 and 13: Set-top-box Router Firmware Code ex
Page 16 and 17: Set-top-box Router Firmware Chroot
Page 22 and 23: Set-top-box Router Firmware Plan 1
Page 32 and 33: Set-top-box Router Firmware Arbitra
Page 45 and 46: Set-top-box Router Firmware Firmwar
Page 51 and 52: Set-top-box Router Firmware Kernel
Page 53 and 54: Set-top-box Router Firmware File sy
Page 55 and 56: Set-top-box Router Firmware Untethe
Page 57 and 58: Set-top-box Router Firmware Untethe
Page 59: Set-top-box Router Firmware Conclus

Pwn@Home An Attack Path to jailbreaking your home router

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?