2025-04-12 20:16 UTC
Actually, I'm wrong: once you overwrite the VID/PID from Extigy to FastTrackPro, you can't trigger the Extigy overwrite again,
Even if you used the FastTrackPro to detect when your heap spray failed, you can't do anything to clean up, and you'll crash anyways on device disconnect.
So maybe they used the FastTrackPro because the out of bound access in `usb_set_configuration` is easier to exploit than the out of bound access->arbitrary free in `usb_destroy_configuration`?
Replies (1)
-
@zhuowei@notnow.dev 2025-04-13 00:40
Here's the ASAN read out of bounds I get in `usb_set_configuration`, using the Extigy + FastTrackPro to trigger CVE-2024-53197. I still get a crash when I unplug the emulated device, so I guess the FastTrackPro wasn't there to avoid a crash? https://gist.github.com/zhuowei/2d3b773c5739664e38521b1ec3043d03