Delivered a workshop at BalcCon this weekend on emulating/sniffing/MitM'ing USB devices with Raw Gadget and a Raspberry Pi. All materials are public, so can go through the workshop on your own if you're interested. github.com/xairy/raw-ga...

Updated syzkaller documentation on USB fuzzing to explain how to handle certain tricky cases (e.g. driver quirks applied based on Vendor/Product IDs). github.com/google/syzka...

Wrote a trigger for CVE-2025-38494/5 (an integer underflow in the HID subsystem) that leaks 64 KB of OOB memory over USB. Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels). github.com/xairy/kernel...

Updated the collection of USB hacking links. github.com/xairy/usb-ha...

Whoever is coming to BalCCon: I will be teaching a workshop Attacking USB with Raw Gadget (covering basics of USB emulation and sniffing). If you wish to attend, you must bring Raspberry Pi 5 along with a few other things, see the workshop description. github.com/xairy/raw-ga...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Linux Kernel netfilter: ipset: Missing Range Check LPE ssd-disclosure.com/linux-kernel...

Announcing #Pwn2Own Ireland for 2025! We return to the Emerald Isle with our new partner #Meta & a $1,000,000 WhatsApp bounty. Plus new USB vectors on phones & more. Read the details https://www.zerodayinitiative.com/blog/2025/7/30/pwn2own-returns-to-ireland-with-a-one-million-dollar-whatsapp-target

Documented instructions for setting up KGDB on Pixel 8. Including getting kernel log over UART via USB-Cereal, building/flashing custom kernel, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over serial, dealing with watchdogs, etc. xairy.io/articles/pix...

Linux Kernel Hardening: Ten Years Deep Talk by Kees Cook about the relevance of various Linux kernel vulnerability classes and the mitigations that address them. Video: www.youtube.com/watch?v=c_Nx... Slides: static.sched.com/hosted_files...

Bypass Kernel Barriers: Fuzzing Linux Kernel in Userspace With LKL Xuan Xing & Eugene Rodionov gave a talk about fuzzing the Linux kernel interfaces fully in user space using LKL (Linux Kernel Library). Video: www.youtube.com/watch?v=Wxmi... Slides: static.sched.com/hosted_files...

Schedule for my Fuzzing/Exploiting the Linux Kernel trainings for the rest of the year ⬇️

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

RVAsec 2025: Kevin Massey - Linux Kernel Exploitation for Beginners youtu.be/YfjHCt4SzQc Linux Kernel Exploitation For Beginners rvasec.com/slides/2025/...

KernelGP: Racing Against the Android Kernel Talk by Chariton Karamitas about ways to use FUSE for kernel exploitation from unprivileged SELinux contexts on Android. www.youtube.com/watch?v=DJBG...

Linux Kernel Exploitation series Awesome series of articles by r1ru that outlines many commonly-used modern exploitation techniques. r1ru.github.io/categories/l...

with offensivecon around the corner, i figured id write another post on linux kernel exploitation techniques - this time i cover the world of page table exploitation! enjoy 🤓 sam4k.com/page-table-k...

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Gave a talk on external fuzzing of Linux kernel USB drivers with syzkaller at SAFACon. Includes a demonstration of how to rediscover CVE-2024-53104, an out-of-bounds bug in the USB Video Class driver. Slides: docs.google.com/presentation...

Unlocking secret ThinkPad functionality for emulating USB devices : xairy.io/articles/thi... credits @andreyknvl.bsky.social

Exploiting the Linux Kernel by Andrey Konovalov (@andreyknvl.bsky.social) www.hexacon.fr/trainer/kono...

Kernel-Hack-Drill: Environment For Developing Linux Kernel Exploits Alexander Popov published the slides from his talk at Zer0Con 2025. a13xp0p0v.github.io/img/Alexande...

My new blog post, which I presented at #Zer0Con2025 A binary level macOS KEXT kernel address sanitizer r00tkitsmm.github.io/fuzzing/2025...

Three bypasses of Ubuntu's unprivileged user namespace restrictions seclists.org/oss-sec/2025...

When Good Kernel Defences Go Bad: Reliable and Stable Kernel Exploits via Defense-Amplified TLB Side-Channel Leaks Awesome paper by Lukas Maar et al. about leaking exploitation-relevant kernel addresses via a TLB side-channel attack. lukasmaar.github.io/papers/useni...

Happy to share my slides from BOOTSTRAP25. Unfortunately the bug discussed is still not patched in Linux 6.14.0 despite it being reported explicitly. Slides are in markdown but there's a PDF in "releases" too github.com/jduck/bs25-s...

New attack surface for Pwn2Own unlocked? 😁 Unprivileged mounting allows reaching a staggering number of bugs in the filesystem drivers; see the syzbot dashboard (click through "Child subsystems"): syzkaller.appspot.com/upstream/s/fs

Updates for the Linux kernel exploitation collection 😋 github.com/xairy/linux-...

Looks like we have a confirmation that Cellebrite uses memory corruptions in Linux kernel USB drivers to unlock Android phones. First 2 bugs seem easily discoverable by syzkaller/syzbot with a bit of extra descriptions. 3rd one is likely as well ⤵️

Pumpkin (@u1f383 on X) does cool work. Here is another cool read about an interesting race condition involving signal handling u1f383.github.io/linux/2025/0...

Patch-Gapping the Google Container-Optimized OS for $0 Detailed article by h0mbre about exploiting a slab use-after-free in the network scheduler subsystem to target the COS 105 kernelCTF instance. h0mbre.github.io/Patch_Gappin...

I gave a day 1 closing keynote at DistrictCon yesterday. Surprisingly, it was a security talk about memory safety. Slides are here: docs.google.com/presentation...

Mali-cious Intent: Exploiting GPU Vulnerabilities (CVE-2022-22706 / CVE-2021-39793) Article by Ng Zhi Yang about exploiting a logical bug in the Arm Mali GPU driver discovered a few years ago. starlabs.sg/blog/2025/12...

Schedule for my Linux kernel security trainings this year is shaping up 🥳 New standalone training: Fuzzing the Linux Kernel. Focused on fuzzing with syzkaller but also covers using/extending KASAN. The usual Exploiting the Linux Kernel training is on the menu as well. ⬇️

I've made an interactive list of #eBPF research papers. Only papers from the top academic conferences, including lots of papers on eBPF verification, kernel offloads, security analysis, etc. pchaigno.github.io/bpf/2025/01/... I plan to keep the list up-to-date.

Updates for the Linux kernel exploitation collection 😋 Happy New Year! 🎉 github.com/xairy/linux-...

Nice paper! 🔥 No fix implemented, AFAIK. Like the general idea that leaking the address of an exploit-controlled object of one type effectively means leaking the address of an object of another chosen type, as we can put the latter object onto the same page via cross-cache.

All videos from The 38th Chaos Communication Congress (38C3) 2024: media.ccc.de/b/congress/2... #cybersecurity #informationsecurity #hacking #exploitation #iOS #android #apple #exploitation #reverseengineering #vulnerability

Small preview of our kernel explorer. Still a lot of work to do! kernelctf-dash.storage.googleapis.com/processed/v6...

Can you find an ITW 0-day from crash logs? Project Zero finds out googleprojectzero.blogspot.com/2024/12/qual...

Tools for controlling webcam LED on ThinkPad X230 github.com/xairy/lights... by @andreyknvl.bsky.social

Earlier this year, I used a 1day to exploit the kernelCTF VRP LTS instance. I then used the same bug to write a universal exploit that worked against up-to-date mainstream distros for approximately 2 months. osec.io/blog/2024-11...

Defects-in-Depth: Analyzing the Integration of Effective Defenses against One-Day Exploits in Android Kernels www.usenix.org/system/files...

Restricting Unprivileged User Namespaces In Ubuntu A talk by John Johansen and Maxime Bélair about restricting capabilities within user namespaces in Ubuntu 24.04. Slides: static.sched.com/hosted_files... Video: www.youtube.com/watch?v=GcVj...