| Issue 51: | Direction Flag Sandbox Bypass | |
| 3 people starred this issue and may be notified of changes. | Back to list |
NaCl applications are able set the direction flag in the EFLAGS register (using std), causing movs and scan instructions to operate in reverse rather than going forward in memory. Since the EFLAGS register is preserved across "system calls", an attacker may set the direction flag and then request a service from the NaCl runtime and cause memory corruption.
|
|||
,
Mar 12, 2009
Team name should be "Beached As" |
|||
,
Mar 12, 2009
(No comment was entered for this change.)
Owner: b...@google.com
|
|||
,
Mar 13, 2009
issue on windows only. |
|||
,
Mar 19, 2009
(No comment was entered for this change.)
Status: Accepted
|
|||
,
Apr 10, 2009
Fix released in build 57.
Status: Fixed
|
|||
 Sign in to add a comment
|
