Nonsense. This is trivial stuff.

Nonsense. This is trivial stuff.

Posted Jul 18, 2009 2:02 UTC (Sat) by mikov (subscriber, #33179)
In reply to: Nonsense. This is trivial stuff. by spender
Parent article: Linux 2.6.30 exploit posted

Bug that results in arbitrary code execution due to a gcc optimization is both clever and important.

I would not qualify a bug as clever. Perhaps you mean the exploit, and yes, it is indeed very clever.

The code optimization angle is not really that important. I am sure that there are many other exploits that depend on how GCC generates its code, so this is no different. For example exploits that depend on the layout of variables in the stack. It is exactly the same thing.

In this case however people are getting confused because the explanation for the exploit depends on parts of the C language which are not so well known.

People aren't involving the C standard or compiler optimizations to talk about a bug, they're talking about how something which by the appearance of the source is unexploitable can be turned exploitable.

Nonsense. Any bug is potentially exploitable - you simply never know. No experienced developer would decide that a bug is 100% un-exploitable, especially one with an invalid pointer dereference. Of course it is not obvious how to exploit it, but it never is.

All crashing bugs are very very important.

---

(Log in to post comments)