Re: [Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy
From: Michal Zalewski (lcamtuf_at_ghettot.org)
Date: 01/27/05
- Previous message: Brad Spengler: "Re: [Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- In reply to: Brad Spengler: "[Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- Next in thread: Brad Spengler: "Re: [Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- Reply: Brad Spengler: "Re: [Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 27 Jan 2005 20:37:19 +0100 (CET) To: Brad Spengler <spender@grsecurity.net>
On Thu, 27 Jan 2005, Brad Spengler wrote:
> I guess anyone who thinks that taking a hardcoded exploit and running it
> 256 times would always result in a successful exploit is stupid.
It would not always result in a successful exploitation; just as flipping
the coin twice is not a guarantee of getting tails once.
Other than that, the amount of randomization is indeed puny; but then,
even 32-bit randomization is a good defense only in certain situations,
and often, can be defeated with some time, aided by luck or a decent
NOP-equivalent sled.
--
------------------------- bash$ :(){ :|:&};: --
Michal Zalewski * [http://lcamtuf.coredump.cx]
Did you know that clones never use mirrors?
--------------------------- 2005-01-27 20:31 --
http://lcamtuf.coredump.cx/photo/current/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- Previous message: Brad Spengler: "Re: [Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- In reply to: Brad Spengler: "[Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- Next in thread: Brad Spengler: "Re: [Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- Reply: Brad Spengler: "Re: [Full-Disclosure] "Advances in Security" in the Linux Kernel and RedHat idiocy"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
