3 ms·
It's been a while since I worked in this area but my recollection was that most JVM security issues in this areas were bypasses of the Java Security Manager oft
by nl 4y ago
It's been a while since I worked in this area but my recollection was that most JVM security issues in this areas were bypasses of the Java Security Manager often by confusing it about code origin. That's all Java code, not C++.
- insanitybit 4y agoIt's been so long I could be remembering incorrectly.
- int_19h 4y agoFor both Java and .NET, there were actual verification bugs, as well - when bytecode that's not supposed to be valid gets past the verifier and results in e.g. mistyped references (which can then be used for all kinds of creative vtable abuse). Sometimes it can even be a bug in the VM spec itself, because implications of two different features interacting weren't fully considered. But, yes, we've tried this idea many times now, and it never held up for long.