Surprisingly enough there are other consumer grade devices where one company controls the entire stack and deliver similar security -- game consoles. xbox os and ios have different designs but make similar security promises.
1,114 karma · joined March 31, 2014
struct AttackerChosenColor {
size_t foreground_color;
size_t background_color;
};
struct Array {
size_t length;
size_t *items;
};
int main() {
// A program creates an array, uses it, frees it, but accidentally forgets that it's been freed and keeps using it anyway. Mistakes happen. This sort of thing happens all of the time in large programs.
struct Array *array = new Array();
...
free(array); // Imagine the allocation is zeroed here like you said. The array length is 0 and the pointer to the first item is 0.
...
struct AttackerChosenColor *attacker = new AttackerChosenColor();
// The allocator can reuse the memory previously used for array and return it to the attacker. Getting this to happen reliably is sometimes tricky, but it can be done.
// The attacker chooses the foreground color. They choose a color value which is also the value of SIZE_T_MAX.
// The foreground_color *overlaps\* with the array's length, so when we change the foreground color we also change the array's size. // Now say the attacker is able to reuse the dangling/stale pointer.
// Say that they can write a value which they want to wherever they want in the array. This is
// Like you suggested it was zeroed when it was freed, but now it's been recycled as a color pair and filled in with values of the attacker's choosing.
// Now the attacker can write whatever value they want wherever they want in memory. They can change return addresses, stack values, secret cookies, whatever they need to change to take control of the program. They win.
if (attacker_chosen_index < array->length) {
array->items[attacker_chosen_index] = attacker_chosen_value;
}
}I agree Firefox could be better, but time spent on effective lobbying which will help all browsers is well spent.
It doesn't make a difference if you're "at will" or factory line or whatever.
[1]: https://medium.com/@crhenr/submitting-your-first-patch-to-th...
Seattle saw a 6% rise last year: https://apnews.com/article/seattle-washington-coronavirus-pa... The Tenderloin, SF saw a 285% rise(!) last year: https://abc7news.com/homeless-in-san-francisco-coronavirus-s...
Unfortunately I don't have a better source for this than an anecdote.