Offensive security researcher specializing in low-level systems security, Windows, Mac, and Linux kernel/hypervisor infrastructure, memory safety, and C code auditing. Focused on upstream vulnerability discovery and responsible disclosure.
qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.
SWTPM_NVRAM_CheckHeader() caused by comparing length against the size of a pointer instead of the structure itself, leading to memory overread when processing untrusted state blobs.