3DS System Flaws: Difference between revisions
mNo edit summary |
mNo edit summary |
||
| (One intermediate revision by the same user not shown) | |||
| Line 1,315: | Line 1,315: | ||
| | | | ||
| smea, [[User:Yellows8|Yellows8]]/others before then | | smea, [[User:Yellows8|Yellows8]]/others before then | ||
|- | |||
| [[GSP_Services|GSP]] client management failures | |||
| Shared memory of GSP clients is all on the same page, this allows any GSP client to craft custom GX commands for other clients. Additionally, [[GSPGPU:TriggerCmdReqQueue]] does not check if the calling client has rendering rights. | |||
These two flaws can be used to craft DMA/Transfer Engine commands within a different GSP client to issue reads/writes to both physical (akin to gspwn) and virtual memory of said client. | |||
| Arbitrary RW from and into a client process. | |||
| None | |||
| [[11.17.0-50|11.17.0-50]] | |||
| | |||
| May 2025 | |||
| [[User:kynex7510|kynex7510]], probably others | |||
|- | |- | ||
| rohax | | rohax | ||