Turning a 27-byte IP fragment into an arbitrary write in U-Boot
U-Boot stores its IP reassembly hole list inside the holes, and a 27-byte fragment lands right on top of it.
found by Nicolas Guigo and Nicolas Bidron, NCC Group
embedded
A fifth length byte: integer overflow and a signed syscall compare in Zephyr RTOS
A greater-than that should have been a greater-than-or-equal lets a remote MQTT packet pick any 32-bit length it likes, and a signed branch instruction lets a user thread pick any function pointer it…
found by Ilya Zhuravlev and Jeremy Boone, NCC Group