Presentations

Presentaciones 2025 CodeBlue 2025 - 18 al 19 de noviembre de 2025 Explotación acelerada con IA: comprometiendo el Pixel habilitado para MTE desde el coprocesador DSP por PAN Zhenpeng y Billy JHENG Bing Jhong Bailando con el coprocesador Exynos: hackeando Samsung por diversión y “beneficio” por...

slides

diapositivas Una colección de diapositivas. 2025 Una historia sobre cómo desafiar a MTE: Rootear Google Pixel con el MTE del kernel habilitado en un solo intento Conferencia: POC 2025 2024 Un bug simple pero no fácil de explotar: Rootear dispositivos Android de una sola vez Conferencia: Cansecwes...

CVE-2026-90094

CVE-2026-90094 affects the Linux kernel on arm64 systems, specifically in the process context-switching path for MTE (Memory Tagging Extension) store-only tag check mode. When a user opts in to store-only tag check via SCTLR_EL1.TCSO0 , that flag was not included in SCTLR_USER_MASK , meaning it w...

CVE-2026-43499-aristotle-apk build-43

Aristotle ADB Enable A minimal Android app that turns on ADB on an au/KDDI Xiaomi "aristotle" XIG04, Android 12 whose developer options can't be reached, using a temporary root obtained from CVE-2026-43499. It is a device-owner tool in the same category as KingRoot: it roots your own phone to fli...

glibc security update

2.28-251.0.4.38 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: May-26-2026 Cupertino Miranda - 2.28-251.0.4.37 - Forward port of Oracle patches Reviewed-by: David Faust May-7-2026 Cupertino Miranda - 2.28-251.0.4.34 - Forward port of Oracle patches Reviewed-by: Jos...

glibc security update

2.28-251.0.4.31 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: February-24-2026 Cupertino Miranda - 2.28-251.0.4.27 - Fixed orabug 38834066 stpcpy MTE support Reviewed-by: Jose E. Marchesi December-8-2025 Cupertino Miranda - 2.28-251.0.3.27 - Forward port of Oracle...

SUSE CVE-2025-71110

In the Linux kernel, the following vulnerability has been resolved: mm/slub: reset KASAN tag in deferfree before accessing freed memory When CONFIGSLUBTINY is enabled, kfreenolock calls kasanslabfree before deferfree. On ARM64 with MTE Memory Tagging Extension, kasanslabfree poisons the memory an...

Linux Distros Unpatched Vulnerability : CVE-2025-71110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/slub: reset KASAN tag in deferfree before accessing freed memory When CONFIGSLUBTINY is...

EUVD-2025-203634

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Do not warn if the page is already tagged in copyhighpage The arm64 copyhighpage assumes that the destination page is newly allocated and not MTE-tagged PGmtetagged unset and warns accordingly. However, following comm...

Linux Distros Unpatched Vulnerability : CVE-2025-40353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: mte: Do not warn if the page is already tagged in copyhighpage The arm64 copyhighpage assumes that the destination page is newly allocated and not...

SUSE CVE-2022-50675

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PGmtetagged if no tags cleared or restored Prior to commit 69e3b846d8a7 "arm64: mte: Sync tags for pages where PTE is untagged", mtesynctags was only called for ptetagged entries those mapped with PROTMT...

CVE-2022-50675

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PGmtetagged if no tags cleared or restored Prior to commit 69e3b846d8a7 "arm64: mte: Sync tags for pages where PTE is untagged", mtesynctags was only called for ptetagged entries those mapped with PROTMT...

UBUNTU-CVE-2022-50675

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PGmtetagged if no tags cleared or restored Prior to commit 69e3b846d8a7 "arm64: mte: Sync tags for pages where PTE is untagged", mtesynctags was only called for ptetagged entries those mapped with PROTMT...

CVE-2022-50675 arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PGmtetagged if no tags cleared or restored Prior to commit 69e3b846d8a7 "arm64: mte: Sync tags for pages where PTE is untagged", mtesynctags was only called for ptetagged entries those mapped with PROTMT...

PT-2025-49706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to Memory Tagging Extension MTE. Specifically, the issue involves incorrectly setting the PG mte tagged bit for pages that were not properly...

Linux Distros Unpatched Vulnerability : CVE-2022-50675

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: mte: Avoid setting PGmtetagged if no tags cleared or restored Prior to commit 69e3b846d8a7 arm64: mte: Sync tags for pages where PTE is untagged,...

glibc bug fix update

2.28-251.0.3.25 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: June-9-2025 Cupertino Miranda - 2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust April-14-2025 Cupertino Miranda - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by:...

glibc security update

2.28-251.0.3.22 - Forward port of Oracle patches Reviewed-by: David Faust Oracle history: April-14-2025 Cupertino Miranda - 2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by: Elena Zannoni March-26-2025 Cupertino Miranda - 2.28-251.0.3.14 - OraBug: 36625686 Add MTE support on string...

glibc security update

2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by: Elena Zannoni Oracle history: March-26-2025 Cupertino Miranda - 2.28-251.0.3.14 - OraBug: 36625686 Add MTE support on string functions Reviewed-by: Jose E. Marchesi March-17-2025 Cupertino Miranda - 2.28-251.0.2.14 - Forward port of...

glibc security update

2.28-251.0.3.16 - Forward port of Oracle patches Reviewed-by: Elena Zannoni Oracle history: March-26-2025 Cupertino Miranda - 2.28-251.0.3.14 - OraBug: 36625686 Add MTE support on string functions Reviewed-by: Jose E. Marchesi March-17-2025 Cupertino Miranda - 2.28-251.0.2.14 - Forward port of...