2 ms·
Note that this can only be exploited if the program is already using a nontransitive comparision function, which is an egregious bug, and the program is setuid
by crotchfire 3y ago
Note that this can only be exploited if the program is already using a nontransitive comparision function, which is an egregious bug, and the program is setuid root.
The odds of a setuid root program having this particular, exotic flaw are miniscule. None have been found in the wild.
- PoignardAzur 3y ago> Note that this can only be exploited if the program is already using a nontransitive comparision function, which is an egregious bug The example they give is "a function cmp(int a, int b) that returns (a - b)", which is definitely a comparison function I've seen before. It's wrong because of overflow, but it's not egregiously wrong. I think it's more significant than you're implying. I wouldn't be surprised if it were used as a step in an exploit chain somewhere in the wild.
- crotchfire 3y agowhich is definitely a comparison function I've seen before. In which setuid-root program?