4 ms·
It’s pretty significant but a strong mitigating factor is that you have to join the network manually before this happens.
by tinus_hn 5y ago
It’s pretty significant but a strong mitigating factor is that you have to join the network manually before this happens.
- OJFord 5y agoSurely more of a mitigating factor is that there's nothing to 'do' with it afterwards? It's easy to get people to (try to) join your WiFi network, but then what? Without some serious secondary effect I'd guess it's probably not getting desperately quick attention or a big payout.
- gpm 5y agoWith arbitrary memory writes, and an apparently reliable form of persistence across reboots, there's a pretty good chance there is something to do with it afterwards (RCE, leading to control of wherever this runs)... it sounds like that part just hasn't been figured out yet.
- swiley 5y agoFormat strings can do arbitrarily memory reads/writes so this will probably quickly turn into an RCE bug (it likely already has but we won't hear for another 90 days unless someone very based decides to tell us.)
- gruez 5y agoI get reads, but writes? How do you manage that? I'm presuming they're using the safe versions of sprintf but in case they're not, they probably have bigger problems.
- Gaelan 5y agoI think printf has a %n specifier that writes the number of characters so far to a pointer passed in.
- _kbh_ 5y agoThis was true maybe 10ish years ago ago but with ASLR, PAC, stack cookies and other mitigations it is now much harder to turn even a legitimate vulnerability (like a trivial buffer overflow) into actual RCE. Theres every likelihood that this isn't actually exploitable, on the other hand it might be, we will have to wait and see.
- deleted 5y ago[deleted]