3 ms·
>Where's the 0-click or the RCE here? See my other comment. There's an exploit in the wild that uses this bug to get RCE, but this specific example just causes
by gruez 1y ago
>Where's the 0-click or the RCE here?
See my other comment. There's an exploit in the wild that uses this bug to get RCE, but this specific example just causes a crash.
- bri3d 1y agoYes, that's what I'm referring to with > I'm actually really curious about how the ITW exploit for this CVE worked It's really weird to see only a single OOB write patched for a full 0-click chain in the wild - how did they get code execution? PAC+ASLR bypass? Sandbox escape/kernel escalation? Literally only RawCamera is patched in the update - were the other bugs in the chain already patched? Too difficult to patch immediately? (ie - close the front door while working on replacing the other locks?)? Still unknown? (ie - found a crash dump from RawCamera but didn't get as sample of the full chain?)