3 ms·
If the Lua "sandbox" is actually a decent sandbox, then the most you could do before was DoS the box. DoS <<<<< RCE
by akoboldfrying 1y ago
If the Lua "sandbox" is actually a decent sandbox, then the most you could do before was DoS the box. DoS <<<<< RCE
- akoboldfrying 1y agoI see downvotes but no explanations why -- what is wrong with my claim?
- chucky_z 1y agoI believe the context is that the CVE is that this bypasses the sandbox entirely; so in this specific case this is a real, full-blown RCE. Your comment makes it seem at a glance that you're saying it's a DOS at worse.
- akoboldfrying 1y agoThanks for replying, but my comment is not saying that at all -- it's pushing back on someone making the claim that the new CVE is no worse than what could already be done, by pointing out that what could already be done was (presumably) only a DoS, while the new CVE is full RCE. I've reread my comment and the parent comment, and I don't understand how this is not clear?
- deleted 1y ago[deleted]