Full Disclosure mailing list archives
RE: Misinformation in Security Advisories (ASN.1)
From: "first last" <randnut () hotmail com>
Date: Mon, 16 Feb 2004 21:15:59 +0000
John Compton john_compton24 () yahoo com wrote:
Another possibility for remote code execution would be to trigger a context-switch mid-memcpy which would halt the memory copy operation before it hits an unpaged address. This, if possible, might leave the heap in a corrupted state but allow another thread to access/traverse the heap before the exception occurs. However, Microsoft compilersoptimize the memcpy() function call to the REPNE MOVSD instruction. This makes it extremely unlikely, if not statistically impossible, toget a context switch at the right time before an unpaged address is accessed. Once again, this cannot be used to exploit this bug.
REP string instructions (eg. REP MOVS), like all other instructions, all check for HW interrupts after each iteration is complete. It is not possible to load ECX with FFFFFFFFh and do a REP LODSD to stop HW interrupts from occuring until ECX is 0.
_________________________________________________________________Plan your next US getaway to one of the super destinations here. http://special.msn.com/local/hotdestinations.armx
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Misinformation in Security Advisories (ASN.1) John Compton (Feb 16)
- Re: Misinformation in Security Advisories (ASN.1) Valdis . Kletnieks (Feb 16)
- Re: Misinformation in Security Advisories (ASN.1) Jeremiah Cornelius (Feb 16)
- <Possible follow-ups>
- RE: Misinformation in Security Advisories (ASN.1) first last (Feb 16)