diaphragmwp@discuss.tchncs.de 4 days ago
From the very little I’ve researched, a DoS with it isn’t hard but for RCE one needs to know some pointers inside… doable if you assume it’s Debian or something then just download a bunch of versions locally and try them.
i_am_not_a_robot@discuss.tchncs.de 4 days ago
Yes, and even for Debian because of ASLR, but these vulnerabilities may allow memory to be leaked and from those memory leaks an attacker can reconstruct the necessary information. That’s obviously not something just anybody could have done, but publicly available AI tools have made this level of attack complexity much more accessible. In www.youtube.com/watch?v=7CiZmq2llDg&t=629s they first find the vulnerability but their AI cheated to make it exploitable. I don’t think having errors enabled is actually necessary for the exploit to work, because if that was the case the PHP security announcement would have said “turn off errors” instead of “turn off your server now.”
diaphragmwp@discuss.tchncs.de 4 days ago
blind rop? Well, if they are using AI they are unlikely to do this in a reasonable amount of time anyway. Also, not sure how one would go on with that if all protectors and pointers change every run and fork like on OpenBSD.