2 ms·
> wthout a JIT, applications can still have arbitrary execution vulnerabilities. Only on operating systems that allow dynamic executable code.
by asdfsa32 1mo ago
> wthout a JIT, applications can still have arbitrary execution vulnerabilities.
Only on operating systems that allow dynamic executable code.
- boomlinde 1mo agoROP https://en.wikipedia.org/wiki/Return-oriented_programming https://en.wikipedia.org/wiki/Return-oriented_programming
- asdfsa32 1mo agoThe page lists a long list of defences.
- boomlinde 27d agoYes, but your claim is that applications can still have arbitrary execution vulnerabilities only on operating systems that allow dynamic executable code. I am refuting that statement by showing that not allowing dynamic executable code is not enough. It is irrelevant to that end that you can mitigate ROP by other means.
- kllrnohj 1mo agoIf a process is allowed to execute code, it's always allowed to execute arbitrary code as well. Those two are fully intertwined, be it via dynamic executable code, ROP chains, because it has an interpreter, or because the initial binary itself already is the malicious payload in the first place. To the OS those are all identical scenarios, it's irrelevant what caused the arbitrary code execution to happen.