There's also this POC code on github and around twitter: https://github.com/ollypwn/cve-2020-0601

- haven't had time to confirm it yet.