| Issue 50: | 2-byte Jump operands Invalid Prefix | |
| 4 people starred this issue and may be notified of changes. | Back to list |
Sign in to add a comment
|
2-byte jump instructions are not examined for valid prefixes. This allows the attacker to jump to somewhere in the address space that hasn't been correctly validated, execute arbitrary code, and defeat the sandbox (by reloading the CS register or similar). The example PoC just executes an instruction that should be disallowed by the sandbox (namely, int3).
|
|||||||||||||
,
Mar 12, 2009
Forgot the team name: "Beached As" |
||||||||||||||
,
Mar 12, 2009
(No comment was entered for this change.)
Status: Accepted
Owner: bradc...@google.com Labels: Type-Defect |
||||||||||||||
,
Apr 10, 2009
Fix was released in build 57.
Status: Fixed
|
||||||||||||||
 Sign in to add a comment
|
||||||||||||||
