handler and the code continues its normal execution like nothing happened ● Uses a Base Log File to trigger the exploit Base Log Format (BLF) Format 0x0000 Control Block 0x0400 Control Block Shadow 0x0800 Create a trigger .blf file 4. Modify the trigger .blf file 5. Find the Base Block (offset 0x800) kernel address of the trigger .blf 6. Call AddLogContainer with the handle of the trigger .blf 7. Create Create a spray .blf file 8. Groom the memory for the spray 9. Trigger the out-of-bounds write.CVE-2023-28252 Exploitation 1. First you need to get the kernel address To bypass ASLR and prepare the

scoped_result = instance_0.value().trigger(); if (!scoped_result) { return std::unexpected(scoped_result.error()); } } { auto scoped_result = instance_0.value().trigger(); if (!scoped_result) return std::unexpected(scoped_result.error()); } } { auto scoped_result = instance_0.value().trigger(); if (!scoped_result) { return std::unexpected(scoped_result.error()); } } // etc. instance_0.trigger(); instance_0.trigger(); instance_0.trigger(); instance_0.trigger(); class_1 instance_1(side_effect); instance_1.trigger(); class_2 instance_2(side_effect); instance_2.trigger();

Controls the execution of one or many tasks • Uses one or many threads to execute the tasks Task trigger Items configures executes Thread Executor Events is added to© 2023 Apex.AI, Inc. | All rights Executing logic with data and publish data Wait again for trigger Fixed-order execution coordinator Wait again for trigger Wait again for trigger Execution cycle completed ACK Yes No Yes No Execute

Will not work unqualified because the call would be ambiguous 2. Algorithm LibFunc will (correctly) trigger ADL lookup1. Swap CPOs simplified implementation: https://godbolt.org/z/sEj8TsYaj (based on example Will not work unqualified because the call would be ambiguous 2. Algorithm LibFunc will (correctly) trigger ADL lookup1 Slides1. C++20 Concepts allow syntactic (structural) conformance but not semantic conformance

into account the inner loops std::vector<Trigger> triggers; triggers.reserve(matrix.rows()); for (const auto& row: matrix) { triggers.push_back(Trigger::create(row)); } 88Algorithmic Complexity

its buffers before acquiring one. 26• Stages of the exception raising process: • Lookup phase: Trigger stack unwinding by calling: “_Unwind_RaiseException()” with: “_UA_SEARCH_PHASE” • In case of failure: failure: call terminate() • In case of success: return “_URC_HANDLER_FOUND” • Cleanup phase: Trigger stack unwinding by calling: “_Unwind_RaiseException()” with: “_UA_CLEANUP_PHASE” PART II: EXCEPTIONS

event())); } stop_when() sends a stop request to its child operation (echo_keyclicks) when its trigger (ctrl_c.event) completes…111 … UNTIL INTERRUPT SENDER COMPLETES template event())); } stop_when() sends a stop request to its child operation (echo_keyclicks()) when its trigger (ctrl_c.event()) completes… (demo 4)118 All that remains is a boat-load of nasty platform-specific

performance-HPC, EU-government-regulation • Must be visible in code • To indicate intent • To trigger analysis • To trigger run-time checks (where needed) Stroustrup - C++ safety -CppCon - October 2023 67Is this

on demand. namespace stdv = std::views; Composing views does nothing yet. Only iteration will trigger computation. Jonathan Müller — @foonathan Back to Basics: Functional Programming in C++ CppCon 2024-09-19 on demand. namespace stdv = std::views; Composing views does nothing yet. Only iteration will trigger computation. Functional pipeline style; no manual state wrangling. Jonathan Müller — @foonathan

independent actors, which autonomously progress through a lifecycle or are early-terminated Trigger-interface APIs: Trigger, handler, or callback invokes subsystem orthogonally to normal system execution flow