bugtraq - RE: Misinformation in Security Advisories (ASN.1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BAY12-F84CdUg07MJJQ0001d06d@hotmail.com>
Date: Mon, 16 Feb 2004 21:15:59 +0000
From: "first last" <randnut@...mail.com>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: RE: Misinformation in Security Advisories (ASN.1)

John Compton john_compton24@...oo.com wrote:
>Another possibility for remote code execution would be to trigger a
>context-switch mid-memcpy which would halt the memory copy operation
>before it hits an unpaged address. This, if possible, might leave the
>heap in a corrupted state but allow another thread to access/traverse
>the heap before the exception occurs. However, Microsoft compilers
>optimize the memcpy() function call to the REPNE MOVSD instruction. This 
>makes it extremely unlikely, if not statistically impossible, to
>get a context switch at the right time before an unpaged address is
>accessed. Once again, this cannot be used to exploit this bug.

REP string instructions (eg. REP MOVS), like all other instructions, all 
check for HW interrupts after each iteration is complete. It is not possible 
to load ECX with FFFFFFFFh and do a REP LODSD to stop HW interrupts from 
occuring until ECX is 0.

_________________________________________________________________
Plan your next US getaway to one of the super destinations here. 
http://special.msn.com/local/hotdestinations.armx

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html