4 ms·
Or if you happen to have some fairly odd code in your executable. All that this really needs is really big array of bytes in one struct of your code. While any
by NateDad 13y ago
Or if you happen to have some fairly odd code in your executable. All that this really needs is really big array of bytes in one struct of your code. While anything that big should be unusual, you never know what crazy stuff people will write.
- tptacek 13y agoOdd code like that will crash your executable, and may set up the conditions for some other exploit, but this one requires the code to be very specifically written to maliciously overwrite a function pointer.
- pcwalton 13y agoWhat if, instead of a function pointer, an interface happened to be at that address? Given that interfaces are extremely common in Go, it seems plausible to me that many addresses in the heap could contain interfaces (and if they don't, then it may be possible to manipulate an application to create many interfaces so that they do). An attacker could overwrite the vtable pointer to point to attacker-supplied memory, and then an indirect call through the vtable could jump to shellcode.
- tptacek 13y agoSure, that's a plausible vulnerability concept for Go. Someone just has to find a way to do that. :)