Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2021-22555: Turning \x00\x00 into 10000$

google.github.io

Post reply on HN
Print view View original

1–10 of 74 posts

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#5

Post by bullen »

Vulnerabilities once you have access to the machine are not really worth spending time on because servers should rely on shell hardening and clients should not be trusted anyway.

What we need is ways to avoid the kernel for networking memory, I figured Oracle would have realized this for Java by now but they are dragging their feet!

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#7

Post by joosters »

I wonder how these vulnerabilities would be treated if the researchers didn't bother to find an exploit for them?

The description of the exploit is so detailed that it gives the impression that discovering the original vulnerability was fairly quick and simple, and the real work is in building a functioning exploit to wriggle through the discovered kernel flaw.

If the researchers were to just stop once they discover the vulnerability, and immediately report it to the kernel security team, would it be treated with the same level of seriousness? Could a CVE with the same severity be issued, or would there be arguments over whether or not the bug is exploitable?

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#9

Post by saagarjha »

joosters wrote: post #7

I wonder how these vulnerabilities would be treated if the researchers didn't bother to find an exploit for them? The description of the exploit is so detailed that it gives the impression that discovering the original vulnerability was fairly quick and simple, and the real work is in building a functioning exploit to wriggle through the discovered kernel flaw. If the researchers were to just stop once they discover…

In general, to be safe you should treat all memory corruption bugs as leading to code execution. Now, it may be difficult to exploit the bug, but more often than not "probably unexploitable" bugs end up being exploitable; even bad primitives like one-byte overwrites or wild copies. Of course, without an exploit you can always just say "ok this is not exploitable, I'm going to ignore it", but such an outlook is generally frowned upon now.
Post reply on HN