3DS System Flaws: Difference between revisions
| Line 478: | Line 478: | ||
! Timeframe this was discovered | ! Timeframe this was discovered | ||
! Discovered by | ! Discovered by | ||
|- | |||
| [[SVC|svcGetThreadList]] process reference leak | |||
| When given a valid process handle (including <code>0xFFFF8001</code>), svcGetThreadList forgets to decrement the reference count of the underlying [[KProcess]] instance, after having finished using it. | |||
| Before [[11.2.0-35|11.2.0-X]]: reference count overflow and therefore use-after-free, but this UAF was most likely not exploitable | |||
| | |||
| [[11.3.0-36|11.3.0-X]] | |||
| April 3, 2017 | |||
| [[User:TuxSH|TuxSH]] | |||
|- | |- | ||
| kernelhax via gspwn | | kernelhax via gspwn | ||