astronaut0703

https://astronaut0703.github.io/astronaut0703 2026-08-22T01:38:32+09:00 astronaut0703 https://astronaut0703.github.io/ Jekyll © 2026 astronaut0703 /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png [Pwn2Own 2025 Canon Review] The Allocator Handed Out One Pointer, but the Code Gave Back Four2026-08-21T10:00:00+09:00 2026-08-21T15:37:53+09:00 https://astronaut0703.github.io/posts/pwn2own-2025-canon-printer-review/ astronaut0703

How a single misplaced free() in Canon's proprietary CPCA protocol turned into a $10,000 remote code execution on a networked office printer — plus my own review of the research.

[DMGuard Review] The CPU Freed the Page, but the GPU Is Still Looking at It2026-08-19T21:00:00+09:00 2026-08-19T21:00:00+09:00 https://astronaut0703.github.io/posts/dmguard-review/ astronaut0703

A review of DMGUARD (USENIX Security 2026), the first runtime defense against physical-page use-after-free across CPU, GPU, and IOMMU translation domains.

3. [Bad epoll CVE-2026-46242] Opening the Kernel: From Arbitrary Read to ROP and Root2026-08-19T00:00:00+09:00 2026-08-19T00:00:00+09:00 https://astronaut0703.github.io/posts/Bad-epoll-CVE-2026-46242-3-opening-the-kernel/ astronaut0703

Goal: the payoff. Reproduce the full chain from the hijacked file: arbitrary read → KASLR bypass → ROP → root. Series Introduction This is the final part of the three-part series on CVE-2026-46242 (Bad Epoll). Part 1 - The Root of the Bug: epoll close-vs-close race and UAF Part 2 - Heap! : the SLUB allocator and cross-cache Part 3 (this article) - Opening the Kernel: from arbitrary re...

2. [Bad epoll CVE-2026-46242] Heap! — The SLUB Allocator and Cross-Cache Attack2026-08-18T00:00:00+09:00 2026-08-18T14:32:54+09:00 https://astronaut0703.github.io/posts/Bad-epoll-CVE-2026-46242-2-heap-and-cross-cache/ astronaut0703

GOAL Understand, from a heap perspective, why the 8-byte write-after-free obtained in Part 1 cannot be exploited with same-cache reuse alone, and how it leads — through a cross-cache attack — to taking control of a struct file. Series Introduction This is the second part of a three-part series analyzing CVE-2026-46242 (Bad Epoll). Part 1 - The Root of the Bug: epoll Close-vs-Close Race...

1. [Bad epoll CVE-2026-46242] epoll close vs close race and UAF2026-08-15T00:00:00+09:00 2026-08-15T00:00:00+09:00 https://astronaut0703.github.io/posts/bad-epoll-cve-2026-46242/ astronaut0703

GOAL Help the reader understand why the UAF occurs and how the 8-byte UAF write primitive works. Series Introduction This is the first part of a three-part series analyzing CVE-2026-46242 (Bad Epoll), a 1-day vulnerability in the Linux kernel’s epoll subsystem. Part 1 (this article) - The Root of the Bug: epoll Close-vs-Close Race and UAF Part 2 - Heap! : The SLUB Allocator and Cross...