News for hackers. Stuff that matters.
Re:Chrome 0-day exploit used in Operation WizardOpium by m00dy on Saturday November 02, 2019 @06:59AM (#21426976)
is it possible to have arbitrary code execution in Go? I'm just curious.
Re:Chrome 0-day exploit used in Operation WizardOpium by roblabla on Saturday November 02, 2019 @09:04AM (#21427434)
Go has a few escape hatches like the unsafe package, but outside from that, I'm pretty sure arbexec isn't achievable in Go. The compiler inserts bounds check to prevent overflows, UAF isn't really achievable thanks to the GC, etc...
Re:Chrome 0-day exploit used in Operation WizardOpium by pcwalton on Saturday November 02, 2019 @11:07AM (#21428073)
You can have UAF in Go due to slicing in the presence of concurrency: the implementation doesn't use multi-word atomics to update fat pointers like slices and interfaces. That said, it's not easy to do so.