Turning a 27-byte IP fragment into an arbitrary write in U-Boot
U-Boot stores its IP reassembly hole list inside the holes, and a 27-byte fragment lands right on top of it.
found by Nicolas Guigo and Nicolas Bidron, NCC Group
U-Boot stores its IP reassembly hole list inside the holes, and a 27-byte fragment lands right on top of it.
found by Nicolas Guigo and Nicolas Bidron, NCC Group