2,293 karma · joined May 28, 2015
[ my public key: https://keybase.io/l1n; my proof: https://keybase.io/l1n/sigs/e8U_3hJ0gp7lCNq9ac2mnXdS1dKhG-eM8SaXZIaPr-Q ]
He gave new life to you, the Wood-feeding cockroachy,
Sent down his angels with feathery antennae,
Who emerged to say the roaches aren't lost to history,
'Scending tree bark stairs.
Hey la, hey la, the roaches are back.
'Scending tree bark stairs.
Hey la, hey la, the roaches are back!
Firstly, we had reports that on certain Linux distributions the stack layout was such that the 4 bytes overwrote an adjacent buffer that was yet to be used and therefore there was no crash or ability to cause remote code execution.
Secondly, many modern platforms implement stack overflow protections which would mitigate against the risk of remote code execution and usually lead to a crash instead.
However as OpenSSL is distributed as source code we have no way of knowing how every platform and compiler combination has arranged the buffers on the stack and therefore remote code execution may still be possible on some platforms.