Vulnerability Research & Exploit Development
Joined September 2022
- Tweets165
- Following413
- Followers1.4K
- Likes1K
Maher Azzouzi retweeted
I wrote an LPE for CVE-2014-3153 AKA Towelroot, a bug in the Linux Kernel that was used to root Android devices earlier. The original exploit is closed source and protected against reverse engineering.
PoC + mini write-up here:
git.io/Jnazk
Maher Azzouzi retweeted
I wrote an LPE exploit for CVE-2017-11176 for Linux Kernel version 4.8.11, I managed to bypass SMEP and SMAP (by stack pivoting inside the kernel and ROP).
The vulnerability is a UAF, and the patch is only 1 line of code.
Exploit and Write-up + Refs here:
git.io/J0p8v
Maher Azzouzi retweeted
I've audited the Android kernel in late 2023, and reported 10+ kernel bugs to Google, along with 2 exploits. Today, I'm releasing the first exploit, targeting the Mali GPU on Pixel devices, accessible from an untrusted_app context.
github.com/0x36/Pixel_GPU_Ex…
Maher Azzouzi retweeted
Slides for "Sanitizing the Linux kernel: On KASAN and other Dynamic Bug-finding Tools", the talk I just gave at Linux Security Summit Europe 2022.
Covers:
🐧 Generic KASAN implementation
🔥 Other Sanitizers
🗡 Extending KASAN and KMSAN to find more bugs
docs.google.com/presentation…
Maher Azzouzi retweeted
Curious about exploiting VMs or memory bugs in a safe language? Read my new blog post, where I attack Firecracker, AWS' VMM written in Rust. Learn about the various layers of virtualization + the attack surface, and how design decisions impact security.
graplsecurity.com/post/attac…