8 ms·
This ("so many ways to exploit modern systems") is not actually true. Yes, plenty of memory-unsafety vulnerabilities exist, but modern mitigations like stack c
by cjbprime 3y ago
This ("so many ways to exploit modern systems") is not actually true.
Yes, plenty of memory-unsafety vulnerabilities exist, but modern mitigations like stack cookies, ASLR, (and sometimes) sandboxing and PAC make it unlikely that e.g. a buffer overflow is exploitable without other factors such as an information leak from your machine back to the attacker. (This might be the case on publicly-accessible servers, but probably not on your laptop.)
The vulnerability being discussed here is unusually dangerous because it's more like command injection, and mitigations aren't going to help.
- throwawaaarrgh 3y agoASLR, PAC, etc are trivial to defeat for an experienced black hat / red team. I'm not even talking about memory safety. That's just one class of exploits. There are so many more to choose from. This vuln isn't that dangerous. It requires a special circumstance and trust. Other vulns don't require those things.