Hacker News Reader

Comment by AndyMcConachie | Hacker News Reader

After reading through the original Qualys discussion[1] of this new vuln I was definitely left with a feeling that this class of bugs has not yet exhausted its treasure trove of vulns. This article only confirms it.

Very interesting discussion that will likely continue as more people wrap their heads around this tough problem.

[1] https://blog.qualys.com/securitylabs/2017/06/19/the-stack-cl...

View on HN

Is it that tough? Everything says Windows/MSVC isn't affected.

Yes. I believe Windows requires you to specify a maximum reserved stack size in the program executable. That's...not going to happen for e.g. Linux.

That's correct and any of the various MS runtime libraries simply set it by default if you didn't. Thus this error[1] (in C) and this[2] (in VB).

I remember these from pre-dotNet days but based on the second link it looks not much has changed in VB.net.

[1]https://msdn.microsoft.com/en-us/library/aa264523(v=vs.60).a... [2]https://docs.microsoft.com/en-us/dotnet/visual-basic/languag...

The reservation is not particularly relevant though.

So how does it detect stack overflows past that limit?

Edit: Looks like a fix for LLVM being proposed (https://reviews.llvm.org/D9653) is just to probe every page that a stack allocation covers, rather than just the final one. Doesn't sound tough at all.

So the title should read "is not closed"? The parenthesis are just annoying. It's one or the other, just state it!

Readers shouldn't have to solve a puzzle to read a title.

First read to me as someone who hadn't read the article was "someone found an ancient kernel hole and declared it closed, but in truth it's actually not," which actually seems to be what was intended... it's a fairly common use of "(not)."

The title is a play on a 2010 LWN headline.

This is explained in the article.

But reading the article has never been a barrier for HN editing a headline to make it less accurate in the past, so why start now? :)

I'm sorry, I'm really confused now.

Here's the title of the article:

An Ancient Kernel Hole is (Not) Closed

I thought that I copy-pasted the article title to be the title of this submission.

Did I omit the parenthesis? If so, it was unintentional, and I apologize.

HN automatically removes certain punctuation from post titles. In a lot of cases though, it creates more confusion. Definitely not your fault.

I did not know that! I'm tempted to experiment now 8-)

Thanks for the heads-up!

Reply on news.ycombinator.com