Re: Retrospective by 'gpg.fail' authors
GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.
Lexi Groves, author of the gpg.fail talk, clarified on oss-security that the first finding was an actual zero-day: a classic printf injection using %n for memory writes, with multiple X.509 certificates in one PEM file to re-enter and defeat ASLR before calling execv@plt. The payload executed the certificate itself, a polyglot file made by inserting a shebang and bash command into the PEM. A second finding was hash-collided by another party before the author could exploit it.
- First gpg.fail finding was a genuine 0day printf format-string injection
- %n writes and multi-certificate PEM files defeated ASLR to call execv@plt
- Payload executed a polyglot PEM certificate with embedded shebang and bash
- Second finding was hash-collided before the author could exploit it
Posted by Lexi Groves (49016) on Sep 15 Hi! Author of the talk here. To clarify: 1 was actually a 0day. Classic printf injection: %n provides memory writes, multiple X.509 certificates in one PEM file to reenter to defeat ASLR, and from there it calls execv@plt. The payload just execv's the certificate, which is a polyglot by simply inserting a shebang and bash command in the PEM file since I was lazy. 2 was unfortunately collided before I managed to exploit it and there...
This source does not provide full text. Read it at seclists.org.