3 ms·
The actual bug is in the Turbofan JIT, not WASM. Using WASM is the method de'jour for turning arbitrary read/write/object leak into RCE. Without WASM, the writ
by albntomat0 6y ago
The actual bug is in the Turbofan JIT, not WASM.
Using WASM is the method de'jour for turning arbitrary read/write/object leak into RCE. Without WASM, the writer would have to use ROP/etc, but the primitives are still there.
Check out this discussion by a bunch of the big names in the field, including Niklas B who was on the team that originally found this bug: https://twitter.com/spoofyroot/status/1379911787282243584 https://twitter.com/spoofyroot/status/1379911787282243584