Post B4sEyo3drjPK7oLmD2 by astraleureka@social.treehouse.systems
 (DIR) More posts by astraleureka@social.treehouse.systems
 (DIR) Post #B4sEynhJClXj0XtwOm by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       Still pissed at Broadcom for not issuing a security advisory for that kernel vulnerability I found a decade ago that affected the Raspberry Pi. They silently refactored the code instead.The offending code is still in FreeBSD, even after I told them to update it, since I never got around to providing a PoC. I should write that PoC I guess, since afaik FreeBSD (and possibly NetBSD) on Raspberry Pi is still vulnerable.
       
 (DIR) Post #B4sEynuQQ02DfE2PqK by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       It is "out of bounds memory write from userspace" level bad fwiw. Though control of where it's written to is basically nil.
       
 (DIR) Post #B4sEyo3drjPK7oLmD2 by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       @endrift any amount of control of the address, or is it just random or fixed? that's one hell of a bug to get swept under the rug
       
 (DIR) Post #B4sEyrwhPUEMBR8HwW by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       Current "fuck you, Broadcom" status: I've managed to wedge a Pi 1 running FreeBSD so hard I had to pull the cable out to get it to reboot. Still not a panic.
       
 (DIR) Post #B4sLk2dq3oLwgvBhDs by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       @astraleureka I actually found that you might be able to read out arbitrary kernel memory if you have access to the dev node while investigating this, but I haven't looked hard enough at the patched version yet. I'm too busy emailing the FreeBSD secteam
       
 (DIR) Post #B4w2mfBIcXyGIoDNoG by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       kernel panic from userspace obtained
       
 (DIR) Post #B4w2mfOPpmSkxULrFo by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       you need permissions to a specific dev node which are restricted to root by default though
       
 (DIR) Post #B4w2mfa78HovXlpCUK by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       Looks like the entire Linux side was cleaned up a decade ago...possibly by someone RPi-affiliated, not BCM-affiliated.RPi also silently swept another kernel vulnerability I discovered under the rug around the same time. Anyway here's the patch for that userspace-triggerable OOB memory write that I reported that never got an advisory: https://github.com/raspberrypi/linux/commit/fef324cd632a3421140205754b8089b102b03f8f
       
 (DIR) Post #B4w2mfq4Aya4LFHwLw by endrift@social.treehouse.systems
       0 likes, 0 repeats
       
       and I reported the still-present-in-FreeBSD vulnerability to the secteam with an actual PoC this time.
       
 (DIR) Post #B4w2mg759iBxC1FWsK by endrift@social.treehouse.systems
       1 likes, 0 repeats
       
       Literally just replied to a 6-year old email where I gave them more details that they'd asked for and then they never followed up further :|
       
 (DIR) Post #B4w2mgJqOGOrpbDilc by endrift@social.treehouse.systems
       1 likes, 1 repeats
       
       anyway e8275dd9e24f05428d4dc955d98f59b165cdf89469bfebe9aa976dbaa35c7641