Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Are you asking what the full exploit chain is here specifically? Because that obviously hasn't been written up yet.

But for the last one, it's the difference between https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... (parser vulnerability leading to not-really arbitrary code execution and memory corruption) and https://googleprojectzero.blogspot.com/2022/03/forcedentry-s... (logic errors leading to a sandbox escape) Notably, the sandbox escape itself did not do anything that would have been prevented by a memory safe language.

The security model of a sandboxed process is that even full arbitrary code execution cannot do anything the sandbox says the process cannot do, and the process the parsers run in is sandboxed to only be able to communicate to other processes through very limited interfaces that have no access to network or disk.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: