Kernel UaF to Root #1: Freeing an Object That’s Still in Use | eShard
www.eshard.com
A use-after-free in Android’s Binder driver, recorded once and replayed at will. Part 1 of a series building a full kernel exploit chain with time travel debugging.