Pumpkin 🎃
@u1f383
Followers
2K
Following
3K
Media
3
Statuses
180
Security researcher at DEVCORE. Focus on Linux kernel.
Joined December 2013
Met the CoR guys and lots of researchers at Hexacon 2025! I’ll never forget it!☺️
We at CoR (+ @u1f383) had a great experience at @hexacon_fr this weekend Met many skilled VR people, the venue was amazing, and the speaker gifts were simply🔥 Best offensive security conference we have seen so far - thanks again to the organizers for the opportunity!
2
0
35
It's awesome that William made a stable exploit to get RCE through the Linux kernel SMB server (ksmbd). It is difficult, but he nailed it! You've got to read his post to see the tricks and strategies he used 😆.
Say hello to Eternal Tux🐧, a 0-click RCE exploit against the Linux kernel from KSMBD N-Days (CVE-2023-52440 & CVE-2023-4130) https://t.co/Cbk9MBo91v Cheers to @u1f383 for finding these CVEs + the OffensiveCon talk from gteissier & @laomaiweng for inspiration!
3
36
264
Wrote a trigger for CVE-2025-38494/5 (an integer underflow in the HID subsystem) that leaks 64 KB of OOB memory over USB. Still works on Pixels and Ubuntus (but the bug is fixed in stable kernels). https://t.co/4IvvqcVs4Q
4
70
452
My research on CVE-2025-38352 (posix-cpu-timers TOCTOU Race condition) which was released in @Android Sept 2025 Bulletin, covering the internals, the patch-fix, vulnerability analysis, and a demo of a PoC that caused a crash in the Android kernel. Blog:
streypaws.github.io
An in-depth exploration of the Linux POSIX CPU Timer Subsystem, including patch analysis and vulnerability insights for Android Kernel CVE-2025-38352.
4
50
203
Last weekend, I participated in corCTF and solved the Android Pwn challenge - corphone. It was a great challenge, and I learned a lot from it. Here's my write-up :) https://t.co/nFtkSjFzyW
u1f383.github.io
Last week, I participated in corCTF as part of team Billy (simply because my friend Billy (@st424204) was also playing it in his free time) and solved an Android pwn challenge, corphone. Although I...
1
53
232
That time when @tehjh was just reviewing a new Linux kernel feature, found a security vuln, then went on a journey to see if he could exploit it from inside the Chrome Linux Desktop renderer sandbox (spoiler: very yes) https://t.co/Atc6toEdAj
0
49
135
Our latest post details how we exploited Retbleed (a CPU vulnerability) to compromise a machine from a sandboxed process and VM! Curious? 👇 https://t.co/CSD8kdlBjD
bughunters.google.com
Curious to hear about our experience exploiting Retbleed (a security vulnerability affecting modern CPUs)? Then check out this post to see how we pushed the boundaries of Retbleed exploitation and...
0
56
210
Inspired by @__sethJenkins's cool research on the adsprpc driver in Android, I took a deep dive into the codebase and documented the internal workings of the @Qualcomm DSP Kernel Driver (FastRPC implementation). Blog:
streypaws.github.io
In depth internals on Qualcomm DSP Kernel (FastRPC implementation)
1
38
112
Reverse engineering Google's undocumented DSP pays off! Our co-workers @st424204 & @Peterpan980927 found the first public vuln in Pixel 8's DSP → kernel takeover MTE? What MTE? 😎 Their talk got accepted at @HacksInTaiwan
https://t.co/kAOAug43ya
hitcon.org
Last year, we uncovered the first publicly known security vulnerability in Google's proprietary Digital Signal Processors (DSP) embedded in the Pixel 8. This processor was previously undocumented and...
3
46
177
Documented instructions for setting up KGDB on Pixel 8. Including getting kernel log over UART via USB-Cereal, building/flashing custom kernel, breaking into KGDB via /proc/sysrq-trigger or by sending SysRq-G over serial, dealing with watchdogs, etc. https://t.co/vb4mgLDJrl
xairy.io
Instructions for getting kernel log, building custom kernel, and enabling KGDB on Pixel 8
5
143
472
corCTF 2025 is a little over a month away!🚩 This year, we have a prize pool worth over 10k, with 9k in cash prizes! 💵 As for the first teaser, we are introducing CoRPhone! Are you ready to pwn an Android kernel, exfiltrate chat logs, and save a 1 million dollar pigeon?👀
1
12
98
Here is our 0day for kernelCTF🩸 - 82k bounty - quickest submission ever - all instances pwned😎 https://t.co/0sb11m8ITD Disclaimer: We apologize for abusing the red black tree family. Turning grandparents against grandchildren is only acceptable in the context of pwn😤
syst3mfailure.io
CVE-2025-38001 is a Use-After-Free vulnerability in the Linux network packet scheduler, specifically in the HFSC queuing discipline. When the HFSC qdisc is utilized with NETEM and NETEM packet...
Exploit write-ups for our 🚨latest 0-day🚨and the tragedy that swept the red black tree family dropping soon 👀 Here is a tiktok style video for those of you with no attention span thanks to slop and social media. Turn on the audio!!!
0
76
309
This will be one of the few OSEE trainings held in Asia. Welcome to Taiwan :) https://t.co/7dTQH8RR4B
blog.orange.tw
✅：『課程結束後一年內要考到 OSEE 證照喔』🍊：「安啦，有一整年能準備哪不行」 （⏳⋯⋯） ✅：『公司下個月開始宣傳課程，到時候要有心得文唷』🍊：「好（默默打開 OffSec 網站排了死線前一天考試）」 （⏳⋯⋯） 🍊：「下禮拜就要考試了，怎麼會這樣 ヽ(ﾟДﾟ≡ﾟДﾟ)ﾉ 」✅：『你到底在幹嘛？？？』 這篇文算是自己準備 OSEE 考試的一點小心得，關於課程內容大家可以參考上一
4
32
267
This post is also available on DEVCORE's blog. en: https://t.co/egE3MHIAUv zh-tw:
0
1
13
A bit late, but I just published my blog post on bypassing Ubuntu’s sandbox! Hope you enjoy it! https://t.co/Q9Nra9n6N0
u1f383.github.io
5
114
391
🚨🚨🚨We just broke everyone’s favorite CTF PoW🚨🚨🚨 Our teammate managed to achieve a 20x SPEEDUP on kctf pow through AVX512 on Zen 5. Full details here: https://t.co/aCIU220IBf The Sloth VDF is dead😵 This is why kernelCTF no longer has PoW!
anemato.de
PoW is gone 🦀🦀
0
37
145
Billy again…
After a dramatic pause in getting things setup Billy(@st424204) and Ramdhan(@n0psledbyte) of STAR Labs preformed a Docker Desktop escape to pop calc - and they are also now off to the disclosure room - good luck! #Pwn2Own #P2OBerlin
2
1
24
Our first confirmation of #Pwn2Own Berlin! Pumpkin (@u1f383) from DEVCORE Research Team used an integer overflow to escalate privs on Red Hat Linux. He earns $20,000 and 2 Master of Pwn points. #P2OBerlin
4
19
152
We are back😎 Say hello to our kernelCTF submission for CVE-2025-37752🩸 Who would have thought you could pwn a kernel with just a 0x0000 written 262636 bytes out of bounds? Read the full writeup at: https://t.co/GkpCjamlaZ 👀
syst3mfailure.io
CVE-2025-37752 is an Array-Out-Of-Bounds vulnerability in the Linux network packet scheduler, specifically in the SFQ queuing discipline. An invalid SFQ limit and a series of interactions between SFQ...
0
55
201