3 ms·

Absolutely not. You’re confusing it for Spectre, probably.

pier25 3y ago
The article mentions: > Memory safety vulnerabilities are coding errors affecting software’s memory management code in which memory can be accessed, written, allocated, or deallocated in unintended ways. How can you do any of this without software running in the local machine? Honestly asking.
- estebank 3y ago
  A specially crafted networking package or file can cause a vulnerable application to get confused enough to interpret input meant to represent data as binary code to be executed. If you have an application that doesn't interact with any inputs, yes, you can avoid a lot of exploits. If the vulnerable application runs in a server, you might be temporarily safe in your local machine, until that server starts being used as a delivery mechanism against all its clients.
- thinkharderdev 3y ago
  To take a very simple example (which won't work on modern OS with ASLR): 1. You have a service that takes some user input 2. The service allocates a buffer on the stack for 20 bytes (the max input allowed) 3. Service doesn't actually validate that the user input is < 20 bytes 4. It writes the input into the buffer, but keeps writing past the end of the buffer. 5. It eventually overwrites the return pointer so now the user input can control where the execution jumps to on return 6. In the user input, the malicious user includes some shell code to do any arbitrary thing they want. 7. The overwrite the return pointer to jump back into the shell code and now they are executing arbitrary code in the server process. This sort of thing was embarrassingly easy to do on old linux kernels before ASLR was implemented. Now it is dramatically harder because there are all sorts of countermeasures in place to prevent it (ASLR, stack canaries, executable vs non-executable memory, etc). To get a sense of what a more modern real world exploit looks like, give https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... a read.
  - pier25 3y ago
    Thanks for the detailed response!
- deleted 3y ago
  [deleted]
- hackideiomat 3y ago
  Sending network packets. Like, I send you a big array of bytes and you write it to a small buffer and therefore I overwrite unintended data.

The article mentions: > Memory safety vulnerabilities are coding errors affecting software’s memory management code in which memory can be accessed, written, allocated, or deallocated in unintended ways. How can you do any of this without software running in the local machine? Honestly asking.

estebank 3y ago
A specially crafted networking package or file can cause a vulnerable application to get confused enough to interpret input meant to represent data as binary code to be executed. If you have an application that doesn't interact with any inputs, yes, you can avoid a lot of exploits. If the vulnerable application runs in a server, you might be temporarily safe in your local machine, until that server starts being used as a delivery mechanism against all its clients.
thinkharderdev 3y ago
To take a very simple example (which won't work on modern OS with ASLR): 1. You have a service that takes some user input 2. The service allocates a buffer on the stack for 20 bytes (the max input allowed) 3. Service doesn't actually validate that the user input is < 20 bytes 4. It writes the input into the buffer, but keeps writing past the end of the buffer. 5. It eventually overwrites the return pointer so now the user input can control where the execution jumps to on return 6. In the user input, the malicious user includes some shell code to do any arbitrary thing they want. 7. The overwrite the return pointer to jump back into the shell code and now they are executing arbitrary code in the server process. This sort of thing was embarrassingly easy to do on old linux kernels before ASLR was implemented. Now it is dramatically harder because there are all sorts of countermeasures in place to prevent it (ASLR, stack canaries, executable vs non-executable memory, etc). To get a sense of what a more modern real world exploit looks like, give https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... a read.
- pier25 3y ago
  Thanks for the detailed response!
deleted 3y ago
[deleted]
hackideiomat 3y ago
Sending network packets. Like, I send you a big array of bytes and you write it to a small buffer and therefore I overwrite unintended data.