Re: Retrospective by 'gpg.fail' authors
GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.
Lexi Groves, author of the gpg.fail talk, clarified on oss-security that the first finding was an actual zero-day: a classic printf injection using %n for memory writes, with multiple X.509 certificates in one PEM file to re-enter and defeat ASLR before calling execv@plt. The payload executed the certificate itself, a polyglot file made by inserting a shebang and bash command into the PEM. A second finding was hash-collided by another party before the author could exploit it.
- First gpg.fail finding was a genuine 0day printf format-string injection
- %n writes and multi-certificate PEM files defeated ASLR to call execv@plt
- Payload executed a polyglot PEM certificate with embedded shebang and bash
- Second finding was hash-collided before the author could exploit it
From the original article
Posted by Lexi Groves (49016) on Sep 15 Hi! Author of the talk here. To clarify: 1 was actually a 0day.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.