A user bought a TP-Link EAP770 v1 access point and traced persistent download corruption and daily Wi‑Fi drops to the device. Large TCP transfers would arrive with 64-byte runs of corrupted bytes but valid TCP checksums, causing TLS/SSH to report bad record MACs. The device shipped on an unchanged, End‑of‑Life firmware with no v1 updates and a restricted TP‑Link shell that prevented writing two sysfs flags known to disable Qualcomm SFE/PPE offload (echo 0 > /sys/sfe/l2_feature and /sys/sfe/ppe_rfs_feature). Unable to flash or patch the closed firmware, the user developed a kernel exploit to gain the necessary root access without rebooting the AP. Using CVE‑2022‑0185 and pipe‑buffer manipulation, they built and tested a chain in QEMU, adapted addresses for the device, and used an overflow to leak kernel pointers, forge pipe ops, read .data to find modprobe_path, and trigger request_module() to run a custom helper - all while keeping a forged pipe alive to avoid panics.
The root cause is a DMA cache coherence bug in Qualcomm’s out‑of‑tree qca‑nss‑dp driver: recycled packet buffers are returned without full CPU cache synchronization, so stale dirty cache lines can be written back after DMA fills the buffer and corrupt part of a packet. SFE/PPE then recomputes checksums over the corrupted payload, yielding valid TCP checksums for damaged data. The writeup includes driver code pointers and notes similar cache‑maintenance issues in other drivers, and documents practical exploit and mitigation steps used to disable the offload and stop the corruption.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Libreboot 26.10 introduces full UEFI support and adds support for 233 Intel/AMD Chromebooks using the EDK2 payload. The release features major design changes, including a new anti-AI policy and enhanced hardware compatibility. (libreboot.org)
X removed 13,000 accounts believed to be involved in election interference before the US midterms. The purge aims to prevent misinformation and foreign meddling during the election period. (theregister.com)
Ukraine has conducted strikes on a fourth Russian data center at Sberbank's facility in the Balakovo region. The attacks target critical infrastructure amid ongoing conflict, with implications for Russia's economic and military capabilities. (reuters.com)
Europe's dependence on US liquefied natural gas is increasing, with US supplying up to two-thirds of the EU's LNG by 2028. US officials have indicated that this reliance could be used strategically, raising concerns about energy security and reliability. (euobserver.com)
EU citizens' private messages are scanned for images and videos under the temporary 'Chat Control' law, with companies like Palantir involved in analyzing the data. Critics argue this law enables mass surveillance, while companies claim it helps combat child abuse. (arvidgrange.substack.com)
Noma Labs discovered a vulnerability in Claude Code Desktop's preview pane that allows arbitrary file reading and data exfiltration through malicious HTML embedded in public repositories. The exploit bypasses sandbox protections, enabling attackers to access sensitive credentials, secrets, and IP addresses. (noma.security)
Today's best Hacker News stories, summarized and screenshotted, one email a day.