3 ms·
I'd like to hear any details of the rumours you're talking about. We looked carefully at this bug and couldn't find any potential for more severe impacts -- ev
by cperciva 13y ago
I'd like to hear any details of the rumours you're talking about. We looked carefully at this bug and couldn't find any potential for more severe impacts -- even the kernel memory leakage is hard for remote attackers, since the memory is leaked to the local side of the connection, not the remote side.
- zaroth 13y agoIt's probably not too hard to get a web server to effectively echo the 'corrupt' / reassembled packet it eventually receives? I guess it depends on how much control you have over the content that directly precedes the disclosed kernel memory. But there are probably ways to get a system to echo the data it receives that are less likely to be logged.
- cperciva 13y agoWeb servers are why we decided that extracting data would be possible in some circumstances; the problems of needing to get the stack fragment to appear in the right place following the right data was why I said it would be difficult.