|
|
Log in / Subscribe / Register

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 6, 2015 23:23 UTC (Wed) by cesarb (subscriber, #6266)
In reply to: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica) by PaXTeam
Parent article: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

> a failed code execution attempt will result in a DoS otherwise it's worse than DoS

Not necessarily. For instance, the attacker might succeed in overwriting some data which later isn't used at all, or is used in a harmless way.

Perhaps the code being attacked was something like "if the value at this field is 7, that other field is a function pointer you should use right now, else do nothing; after that, reinitialize all the fields with valid data from elsewhere", and the attacker misaligned the padding and wrote 7 to the wrong field (suppose for the sake of argument that the vulnerability being used doesn't allow for a write outside the object bounds, or a write at any other time than just before that test for 7, and there's no multithreading involved). Unless the attacker hits the correct field with a 7, we have a failed code execution, but which doesn't result in a DoS.


to post comments

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 6, 2015 23:42 UTC (Wed) by PaXTeam (guest, #24616) [Link]

a failed code execution attempt is when the redirected code execution flow doesn't hit the intended target and tries to execute unmapped memory or unintended instructions that will very likely crash in short order. modifying data is not 'code execution attempt' per se, there has to be a moment when intended control flow is hijacked.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds