[userbinator]

One of the first comments there with the partial ARM opcode map shows why this vulnerability is "theoretical" - you can overflow the buffer, but the bytes written to the buffer are restricted so much (values will always be between 43 and 126) that it would be nearly impossible to write useful exploit code.

The details are here:

http://securityintelligence.com/android-keystore-stack-buffe...

[nutate]

"nearly impossible to write useful exploit code" sounds like a worthy challenge to some people I know.