undefined | Better HN

0 pointsasveikau6y ago0 comments

> in a lot of cases, it will be harmless; and in the worst case it will crash with a segfault.

I am not sure if a segfault is always the worst case. It could be by some coincidence that array[i] contains some confidential information [maybe part of a private key? 32 bits of the user's password?] and you've now written it to a log file.

I know it's hard to imagine a mis-read of ~32 bits would have bad consequences of that sort, but it's not out of the question.

0 comments

4 comments · 1 top-level

saagarjha6y ago· 3 in thread

Misreads of much less than that have been exploitable in the past.

asveikauOP6y ago

Depends a lot on the specifics. For example heartbleed was a misread that led to the buffer being sent on the socket. And I think it was more than 32 bits. 32 bits of garbage into a log file that needs privileges to read sounds a tad less scary, but like I say, not out of the question to be harmful.

memling6y ago

> Depends a lot on the specifics. For example heartbleed was a misread that led to the buffer being sent on the socket. And I think it was more than 32 bits. 32 bits of garbage into a log file that needs privileges to read sounds a tad less scary, but like I say, not out of the question to be harmful.

If you can do it a lot of times, though, that changes matters.

saagarjha6y ago

32 bits is plenty to effectively break ASLR or significantly weaken a cryptographic key.

j / k navigate · click thread line to collapse