3 ms·
Most of the DoS vulnerabilities appear to be null pointer dereferences, those are not exploitable simply because the attacker has no control over the pointer, i
by tux3 12y ago
Most of the DoS vulnerabilities appear to be null pointer dereferences, those are not exploitable simply because the attacker has no control over the pointer, it's always just null and it always crashes 'cleanly'. The same goes for the DoS-by-assert, those just kill the program, no direct chance for exploitation there.
The memory corruptions and use-after-frees are a bit more worrying, but they look pretty hard to trigger in real life.
Of course you should still upgrade asap, if that's the reason you're asking.
- ctz 12y agoWrites through a null (or low valued) pointer can actually be easily exploitable on some embedded systems. https://cansecwest.com/csw07/Vector-Rewrite-Attack.pdf https://cansecwest.com/csw07/Vector-Rewrite-Attack.pdf
- tptacek 12y agoThey're easily exploitable if (a) they're writes, (b) they're arbitrary, (c) they're targeting an architecture with an IVT mapped at 0x0, and (d) they're in code that can actually write the IVT (ie, an RTOS, or kernel code). That's a pretty rare set of circumstances. NULL pointer writes are also exploitable in the general case if they're offset, but none of these appear to be.
- fulafel 12y agoAlso in many other circumstsances on general purpouse operating systems like Windows, Linux, OS X. There are a zillion examples just a web search away. Many well publicized and documented high profile RCE NULL vulns in browsers, Flash, kernels etc.