GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older).

Two boot looped, I had to enter recovery and the other just powered off [0].

The demo modifies the wallpaper on supported Pixel devices.

[0] IonStack https://rootme.nebusec.ai

____

Tip: Install a Chromium flavor browser (Chromite) separate from the main browser.

Disable Javascript and hardware accelerated video decoder (commonly exploited) from the flags page and enable reader mode to fix broken JS-dependent websites when browsing blogs and random sites on your personal devices, else dedicate a tablet.

Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.

>Google has rewarded us $92,337 in kernelCTF

I'm all ears now

Daaaaamn: "GhostLock was introduced in Linux 2.6.39 and fixed in Linux 7.1."

dupe of https://news.ycombinator.com/item?id=48834309

A what?