mailing list archives
Re: CVE request -- kernel: execshield: predictable ascii armour base address
From: Nick Kralevich <nnk () google com>
Date: Tue, 20 Mar 2012 09:01:39 -0700
Can someone explain to me why this is worthy of a CVE? I can see this as a
bug of course. But a "vulnerability"?
This bug, by itself, does not cause a vulnerability. It just makes
vulnerabilities easier to exploit. I'm not sure this is worthy of a CVE
unless we're willing to assign CVEs to all fixed address allocations.
On Tue, Mar 20, 2012 at 6:10 AM, Eugene Teo <eugene () redhat com> wrote:
On 03/20/2012 06:20 PM, Petr Matousek wrote:
When running a binary with a lot of shared libraries, predictable base
address is used for one of the loaded libraries.
This flaw could be used to bypass ASLR.
Nick Kralevich | Android Security | nnk () google com | 650.214.4037