8 ms·
Right. There was >= 1 mistake I made during the analysis and reporting phase, but all parties agree that adopting urandom is still a good idea.
by sarciszewski 12y ago
Right. There was >= 1 mistake I made during the analysis and reporting phase, but all parties agree that adopting urandom is still a good idea.
- tptacek 12y agoIt's frustrating because mt_rand is just complicated enough to require this analysis. You should look at it the same way you do an uninitialized pointer variable in C, or maybe an offset NULL pointer write: very bad, but not necessarily exploitable.
- sarciszewski 12y agoOf course. I proposed a theoretical way to abuse a hypothetical RNG prediction (if any were possible). Whether or not it's exploitable is, frankly, far above my understanding or pay grade. Whether it's exploitable today, versus whether it will be exploitable 10 years from now are even harder to say. If any advancements are made that cause the existing wp_rand() to become more fragile, it will probably be people far more intelligent than I am that will think of it. (Disclaimer: Considering I don't and probably never will get paid for any of the bugs/patches I submit to open source projects, that pay grade is effectively $0.) I'm only interested in seeing it fixed rather than proving that it can be pwned. Getting a CVE and then posting to FD were just steps I took because it appeared that I was being ignored. I now know that it wasn't intentional.