4 ms·
“Arbitrary code execution” is a bit of a stretch. It’s a sandboxed Ruby interpreter, not a ROP chain that pops a shell logged in as root.
by sjtgraham 7y ago
“Arbitrary code execution” is a bit of a stretch. It’s a sandboxed Ruby interpreter, not a ROP chain that pops a shell logged in as root.
- lone_haxx0r 7y agoHow do you know that there aren't any vulnerabilities in the interpreter that could lead to taking over the system?
- comex 7y agoYou would still have to find an exploit for the kernel or other system components in order to break out of the game's sandbox.
- leggomylibro 7y agoThat is how a lot of exploits start, though. Certain PSP games used to be valuable because you could present them with crafted save files to root devices. Although, you could also buy special batteries that would let you root a PSP...what a weird handheld. The point is, who knows, the game's scripting language could have shipped with an undocumented 'write word to memory' function.
- saagarjha 7y agoNote that a game with a "write word to memory" function would still need to be able to break out of the sandbox.
- deleted 7y ago[deleted]
- saagarjha 7y agoWell, how do you know this isn't true for your favorite game?