Timing Attack for Exploitation and VR in the wake of Rust

03 May 2023

Show Notes

208 - Timing Attack for Exploitation and VR in the wake of Rust

Additional Links: https://djangocas.dev/blog/python/python-unicode-string-lowercase-casefold-caseless-match/ https://djangocas.dev/blog/python/python-unicode-string-lowercase-casefold-caseless-match/

00:09:21

RCE in the Microsoft Windows DHCPv6 Service [CVE-2023-28231]

This one is easy enough, missing a bounds check when handling nested messages allowed for sending a message with a bunch of nested messages that would be parsed and written out of bounds on a fixed size buffer.

00:12:29

PSPRAY: Timing Side-Channel based Linux Kernel Heap Exploitation Technique

00:22:16

Rust and the future of VR

Additional Links: https://www.theregister.com/2023/04/27/microsoft_windows_rust/ https://twitter.com/dwizzzleMSFT/status/1652003654415831040 https://www.youtube.com/watch?v=8T6ClX-y2AE https://www.phoronix.com/news/sudo-su-rewrite-rust https://www.openwall.com/lists/oss-security/2021/01/26/3