2 ms·

Not sure what you mean. There was no mention about executing anything in the heap (or stack for that matter). I have no reason to believe VLC maps (a part of)

Not sure what you mean. There was no mention about executing anything in the heap (or stack for that matter). I have no reason to believe VLC maps (a part of) its heap RWX (=read + write + execute). This kind of exploits don't even require memory to be executable. C++ virtual methods cause the compiler to add vPtr (that is writable, because it's contained in the object) and vTable. Modifying vPtr can be used for making certain class execute code somewhere else (or mostly crashing :-)). However, neither vPtr and vTable themselves are executable. vTable doesn't even need to be writeable. If you can somehow do indirect vTable reads, you'll learn ASLR [0] base for the module. With that information you might be able to circumvent ASLR, and eventually be able to pull off code execution through a ROP [1] chain. A C-style function pointer would be easier to use for a similar effect. [0]: https://en.wikipedia.org/wiki/Address_space_layout_randomization https://en.wikipedia.org/wiki/Address_space_layout_randomiza... [1]: https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming

vardump 7y ago
Hmm... downvotes? Is there some technical issue or something else? Some evidence VLC had writable and executable pages in heap?
MuffinFlavored 7y ago
> This kind of exploits don't even require memory to be executable. If this exploit is a memory leak, and the memory isn't executable, how do the malicious contents that get put into the leaked memory get executed?
- vardump 7y ago
  Possibly through a ROP chain. Abusing VLC's code itself. You don't need memory that's writeable and executable for that. Check the Wikipedia link in my comment about ROP exploits.
  - gubbrora 7y ago
    Just elaborating on this. One way of looking at it is that we turn the attacked program into an interpreter thus bypassing the requirement for executability. It turns out that a lot of programs can be tricked into interpreting a family of languages called rop chains.

vardump 7y ago

Hmm... downvotes? Is there some technical issue or something else? Some evidence VLC had writable and executable pages in heap?

MuffinFlavored 7y ago

> This kind of exploits don't even require memory to be executable. If this exploit is a memory leak, and the memory isn't executable, how do the malicious contents that get put into the leaked memory get executed?

vardump 7y ago
Possibly through a ROP chain. Abusing VLC's code itself. You don't need memory that's writeable and executable for that. Check the Wikipedia link in my comment about ROP exploits.
- gubbrora 7y ago
  Just elaborating on this. One way of looking at it is that we turn the attacked program into an interpreter thus bypassing the requirement for executability. It turns out that a lot of programs can be tricked into interpreting a family of languages called rop chains.