关于这一集
Mobile security boundaries rely on isolating remote, untrusted inputs from highly privileged system components. However, when new automated features are introduced, the available attack surface can shift—sometimes exposing unexpected code paths to remote attackers.
In the latest episode of Behind the Binary, we sit down with Seth Jenkins from Google Project Zero to dissect a full two-bug, zero-click exploitation chain targeting the Pixel 9. By chaining a user-space decoder flaw with a kernel driver race condition and a kernel ASLR bypass, researchers achieved remote code execution and a device-wide SELinux sandbox escape.
Key takeaways from our technical breakdown:
- The AI Attack Surface Shift: How implementing automatic voice message transcription inadvertently exposed the Dolby audio decoder (EAC3) to remote inputs.
- Defeating Userland ASLR: The mechanics of an integer overflow in user space (CVE-2025-54957) and how a partial pointer overwrite bypassed ASLR.
- Rigging the Race Condition: A look inside the "Big Wave" kernel driver use-after-free (CVE-2025-36934), a single bug that allows an attacker to jump from the mediacodec sandbox to the kernel. .
- The Predictable KASLR Reality: How standard ARM64 linear mapping combined with static bootloader placements negated kernel randomization—allowing two arbitrary writes to escalate privileges to root with SELinux disabled.
Join the Community
- Research Hub: Threat research, training events and news:
https://cloud.google.com/security/flare - The FLARE Insider: Get community updates and announcements. To subscribe, email flare-external@google.com
FOLLOW THE SHOW:
- Subscribe: Apple Podcasts | Spotify | YouTube
英语
美国
文字稿 🔗
Are you the producer of this podcast?
Add a podcast transcript
Need Audio-to-Text?
Transcribe with Listen411 in Just 60 Seconds
本播客中的其他单集
In this episode, we’re joined by Nino Isakovic, a long-time low-level security expert, for a thought-provoking conversation that spans the foundational and the cutting-edge. Nino discusses the art of deconstructing problems—sharing insights on how to learn effectively, the building blocks of a ro...
In this episode, Dhillon Kannabhiran shares the gritty origin story of Hack in the Box (HITB), detailing how he dug a $20k financial hole to launch the first event in Malaysia before building it into a global brand.
The conversation moves beyond conferences to explore the cutting edge of technolo...
In this episode, we're asking the question: "What Lurks Beneath?" We're joined by Mark Overholser, a Technical Marketing Engineer at Corelight who's part of the team running the Black Hat Network Operations Center (NOC). We discuss the incident during Black Hat 2025 that ...
In this episode, we sit down with Nick Harbour, Blas Kojusner, Moritz Raabe, and Sam Kim — members of the FLARE Team and some of this year’s challenge authors — for a deep dive into the design and execution of FLARE-On 12. The team discusses the complexity and intent behind this year's chall...
In this episode, we get a unique look at the history of Windows through the eyes of one of its leading experts, Pavel Yosifovich. We delve into his fascinating origin story, including the "fluke" that led him to become the author of the legendary Windows Internals series, and why he des...
免责声明: 本页面嵌入的播客和封面图片来自 Josh Stroschein，归其所有者所有，与 Listen Notes, Inc. 无关联，也未获得 Listen Notes, Inc. 背书。
