slides

幻灯片 一个幻灯片合集。 2025 挑战 MTE 的故事：在内核启用 MTE 的情况下一次性 Root Google Pixel 会议：POC 2025 2024 简单的漏洞但难以利用：一次性 Root Android 设备 会议：Cansecwest 2024 与（POC 2023）几乎相同，除了 MTE 2023 简单的漏洞但难以利用：一次性 Root Android 设备 会议：POC 2023 供应商特定的缓解绕过详情已被移除。抱歉。 GPU 加速的 Android Root 技术 会议：MOSEC 2023 让 KSMA 再次伟大：利用 GPU MMU 特性 Root...

Presentations

プレゼンテーション 2025 CodeBlue 2025 - 2025年11月18日〜19日 AIで加速するエクスプロイト：DSPコプロセッサからMTE対応Pixelを侵害する 発表者：PAN Zhenpeng & Billy JHENG Bing Jhong Exynosコプロセッサと踊る：楽しみと「利益」のためにSamsungをPwnする 発表者：Muhammad Ramdhan, PAN Zhenpeng & Billy JHENG Bing Jhong HITCON 2025 - 2025年8月15日〜16日 Pixel 8をクラックする：未公開DSPを悪用してMTEをバイパスす...

SUSE CVE-2026-89981

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...

SUSE CVE-2026-90094

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

CVE-2026-90094

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

CVE-2026-90094

CVE-2026-90094 affects the Linux kernel on arm64 systems, specifically in the process context-switching path for MTE (Memory Tagging Extension) store-only tag check mode. When a user opts in to store-only tag check via SCTLR_EL1.TCSO0 , that flag was not included in SCTLR_USER_MASK , meaning it w...

CVE-2026-90094: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

PT-2026-94638

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the arm64 architecture during hibernation where the DAIF Driver, Asynchronous abort, IRQ, and FIQ state is not properly restored upon an error. Specifically, if the...

CVE-2026-89981 arm64: Don't read GMID_EL1 when MTE is disabled

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...

CVE-2026-89981: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: Don't read GMIDEL1 when MTE is disabled cpuinfostorecpu gates the GMIDEL1 read on the raw IDAA64PFR1EL1, so it reads the register even when the kernel has disabled MTE CONFIGARM64MTE=n or arm64.nomte. KVM sets HCREL2.TID5 ...

CVE-2026-43499-aristotle-apk build-43

Aristotle ADB Enable A minimal Android app that turns on ADB on an au/KDDI Xiaomi "aristotle" XIG04, Android 12 whose developer options can't be reached, using a temporary root obtained from CVE-2026-43499. It is a device-owner tool in the same category as KingRoot: it roots your own phone to fli...

glibc security update

2.28-251.0.4.38 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: May-26-2026 Cupertino Miranda - 2.28-251.0.4.37 - Forward port of Oracle patches Reviewed-by: David Faust May-7-2026 Cupertino Miranda - 2.28-251.0.4.34 - Forward port of Oracle patches Reviewed-by: Jos...

glibc security update

2.28-251.0.4.31 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi Oracle history: February-24-2026 Cupertino Miranda - 2.28-251.0.4.27 - Fixed orabug 38834066 stpcpy MTE support Reviewed-by: Jose E. Marchesi December-8-2025 Cupertino Miranda - 2.28-251.0.3.27 - Forward port of Oracle...

SUSE CVE-2025-71110

In the Linux kernel, the following vulnerability has been resolved: mm/slub: reset KASAN tag in deferfree before accessing freed memory When CONFIGSLUBTINY is enabled, kfreenolock calls kasanslabfree before deferfree. On ARM64 with MTE Memory Tagging Extension, kasanslabfree poisons the memory an...

Linux Distros Unpatched Vulnerability : CVE-2025-71110

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/slub: reset KASAN tag in deferfree before accessing freed memory When CONFIGSLUBTINY is...

CVE-2025-71110: Use After Free

In the Linux kernel, the following vulnerability has been resolved: mm/slub: reset KASAN tag in deferfree before accessing freed memory When CONFIGSLUBTINY is enabled, kfreenolock calls kasanslabfree before deferfree. On ARM64 with MTE Memory Tagging Extension, kasanslabfree poisons the memory an...

EUVD-2025-203634

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Do not warn if the page is already tagged in copyhighpage The arm64 copyhighpage assumes that the destination page is newly allocated and not MTE-tagged PGmtetagged unset and warns accordingly. However, following comm...

CVE-2025-40353: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Do not warn if the page is already tagged in copyhighpage The arm64 copyhighpage assumes that the destination page is newly allocated and not MTE-tagged PGmtetagged unset and warns accordingly. However, following comm...

Linux Distros Unpatched Vulnerability : CVE-2025-40353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: mte: Do not warn if the page is already tagged in copyhighpage The arm64 copyhighpage assumes that the destination page is newly allocated and not...

SUSE CVE-2022-50675

In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PGmtetagged if no tags cleared or restored Prior to commit 69e3b846d8a7 "arm64: mte: Sync tags for pages where PTE is untagged", mtesynctags was only called for ptetagged entries those mapped with PROTMT...