8 ms·
Writes through a null (or low valued) pointer can actually be easily exploitable on some embedded systems. https://cansecwest.com/csw07/Vector-Rewrite-Attack.p
by ctz 12y ago
Writes through a null (or low valued) pointer can actually be easily exploitable on some embedded systems.
https://cansecwest.com/csw07/Vector-Rewrite-Attack.pdf https://cansecwest.com/csw07/Vector-Rewrite-Attack.pdf
- tptacek 12y agoThey're easily exploitable if (a) they're writes, (b) they're arbitrary, (c) they're targeting an architecture with an IVT mapped at 0x0, and (d) they're in code that can actually write the IVT (ie, an RTOS, or kernel code). That's a pretty rare set of circumstances. NULL pointer writes are also exploitable in the general case if they're offset, but none of these appear to be.
- fulafel 12y agoAlso in many other circumstsances on general purpouse operating systems like Windows, Linux, OS X. There are a zillion examples just a web search away. Many well publicized and documented high profile RCE NULL vulns in browsers, Flash, kernels etc.