3 ms·

Is it fair to say that JITs are usually restricted to memory-safe languages, which don't rely so much on machine-level defenses? I guess you're losing something

Is it fair to say that JITs are usually restricted to memory-safe languages, which don't rely so much on machine-level defenses? I guess you're losing something if you load a C library into your Java program, because exploits in the C library can do more damage now. But at the same time, having the majority of your code in Java is probably a win for security?

EthanHeilman 10y ago
The idea is to leverage heap spraying[0] in the pages to write shell code which can then be triggered from another vulnerability in the program. This shell code could live in some string in a chunk of javascript. Thus, this technique does not need to violate the memory safety of the JITTed code. This can be partially mitigated using constant blinding[1] but it isn't perfect. [0]: https://en.wikipedia.org/wiki/Heap_spraying https://en.wikipedia.org/wiki/Heap_spraying [1]: https://www.internetsociety.org/doc/dachshund-digging-and-securing-non-blinded-constants-jit-code https://www.internetsociety.org/doc/dachshund-digging-and-se...