Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2021-22555: Turning \x00\x00 into 10000$

google.github.io

Post reply on HN
Print view View original

31–40 of 74 posts

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#31

Post by vsareto »

josefx wrote: post #24
vsareto wrote: post #3

I'll never not be impressed by the people who can find stuff like this

Open C source file, read five minutes, done. The existence of C style strings by itself already guarantees that any C code will be 50% memory access exploits. Sadly instead of adopting one of hundreds sane string types that have been around as long as C if not longer the C standards committee only did the the C equivalent of my_sql_real_escape_string by introducing dozens of overloads that let you specify a "string s…

You're not just finding functions, but also how to affect memory, bypass security controls, and many other things to get a stable exploit

I kinda feel like you the other poster suggesting to just search source code learned basic buffer overflows from the 90s and called it a day

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#32

Post by fareesh »

For folks who are operating at this layer of bounds and overflows and such, are you relying entirely on a mental visualization of the data structures when reasoning about them? Or does this kind of exercise require some sketching etc? I find it to be quite challenging to explore these topics without having to draw on paper, so I was curious as to whether this is something that you eventually graduate from, or whether sketching things out remains a large part of the process.

Are there some tools that help this kind of thought process? Or do you have to use drawing primitives - rectangles, etc to do it?

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#33

Post by kevincox »

jcims wrote: post #29
goodpoint wrote: post #23

Earlier quoted context omitted.

Find stuff and give it away for very little money. Such vuln could sell for much more.

The access I have at work is extremely valuable in that same market. Should I sell that too?

"Should"? Morally no. But you could likely make a lot of money if you found the right buyer.

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#34

Post by isatty »

fareesh wrote: post #32

For folks who are operating at this layer of bounds and overflows and such, are you relying entirely on a mental visualization of the data structures when reasoning about them? Or does this kind of exercise require some sketching etc? I find it to be quite challenging to explore these topics without having to draw on paper, so I was curious as to whether this is something that you eventually graduate from, or whether…

There's absolutely nothing wrong with drawing it out on paper - why give yourself a hard time by trying to do without?

I occasionally write it out even if its dead simple if else logic but nested.

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#35

Post by airstrike »

isatty wrote: post #34
fareesh wrote: post #32

For folks who are operating at this layer of bounds and overflows and such, are you relying entirely on a mental visualization of the data structures when reasoning about them? Or does this kind of exercise require some sketching etc? I find it to be quite challenging to explore these topics without having to draw on paper, so I was curious as to whether this is something that you eventually graduate from, or whether…

There's absolutely nothing wrong with drawing it out on paper - why give yourself a hard time by trying to do without? I occasionally write it out even if its dead simple if else logic but nested.

I actually appreciate seeing someone draw something complex out on paper because it shows they care enough to make sure they get it right.

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#36

Post by bitexploder »

fareesh wrote: post #32

For folks who are operating at this layer of bounds and overflows and such, are you relying entirely on a mental visualization of the data structures when reasoning about them? Or does this kind of exercise require some sketching etc? I find it to be quite challenging to explore these topics without having to draw on paper, so I was curious as to whether this is something that you eventually graduate from, or whether…

I often have loaded memory in a hex editor with most of the data types within marked off so you can visually see the separate elements. Like, if you knowingness four bytes are a an integer they get colored one way, etc. I am much of a drawer or white boarder.

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#37

Post by EvanAnderson »

airstrike wrote: post #35
isatty wrote: post #34

Earlier quoted context omitted.

There's absolutely nothing wrong with drawing it out on paper - why give yourself a hard time by trying to do without? I occasionally write it out even if its dead simple if else logic but nested.

I actually appreciate seeing someone draw something complex out on paper because it shows they care enough to make sure they get it right.

The old Microsoft "Behind the Code" video series always asked their guests (Microsoft employees who distinguished themselves with technical accomplishments in their careers) to draw and explain their favorite data structure. I loved that bit of the shows. (If you haven't seen them I would highly recommend them.)

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#39

Post by nine_k »

joosters wrote: post #7

I wonder how these vulnerabilities would be treated if the researchers didn't bother to find an exploit for them? The description of the exploit is so detailed that it gives the impression that discovering the original vulnerability was fairly quick and simple, and the real work is in building a functioning exploit to wriggle through the discovered kernel flaw. If the researchers were to just stop once they discover…

So you think it's too much work for $10k? I won't write off just the desire to nail it beyond doubt to secure the bounty.

Re: CVE-2021-22555: Turning \x00\x00 into 10000$

#40

Post by nine_k »

pjmlp wrote: post #21
joosters wrote: post #7

I wonder how these vulnerabilities would be treated if the researchers didn't bother to find an exploit for them? The description of the exploit is so detailed that it gives the impression that discovering the original vulnerability was fairly quick and simple, and the real work is in building a functioning exploit to wriggle through the discovered kernel flaw. If the researchers were to just stop once they discover…

It was, the first step to find out bugs in C (and C++) code always starts the same way "...inspired me to grep for memcpy() and memset() in the Netfilter code. This led me to some buggy code." .

Does C++ code even use memcpy these days? A honest question.
Post reply on HN