CVE-2019-1347: When a mouse over a file is enough to crash your system

Re:CVE-2019-1347: When a mouse over a file is enough to cras... by Varriount on Saturday November 16, 2019 @08:48PM (#21556061)

But here's a question - supposing that this functionality was moved into a hypothetical library "pe.dll"/"pe.exe", how would the kernel load this library or executable? Wouldn't one run into a catch-22 situation?

[ Parent | on HN ]

Re:CVE-2019-1347: When a mouse over a file is enough to cras... by scintill76 on Saturday November 16, 2019 @09:11PM (#21556136)

I think they're saying that userland should handle whatever the mouseover is trying to do (another comment says it displays author and version info embedded in the exe). Things that actually require kernel privileges would remain in the kernel.

[ Parent | on HN ]

Re:CVE-2019-1347: When a mouse over a file is enough to cras... by paulddraper on Saturday November 16, 2019 @10:31PM (#21556397)

The kernel would probably statically link it.

[ Parent | on HN ]

Re:CVE-2019-1347: When a mouse over a file is enough to cras... by saagarjha on Sunday November 17, 2019 @06:29AM (#21557486)

…wouldn’t that have the effect of bringing this code back into the kernel’s address space?

[ Parent | on HN ]

Re:CVE-2019-1347: When a mouse over a file is enough to cras... by paulddraper on Sunday November 17, 2019 @06:52PM (#21560874)

The code itself would be in the kernel, but the "parsing while mousing over" invocation would be on userspace code.

That is, the parse logic could be a library linked by multiple application.

[ Parent | on HN ]

Re:CVE-2019-1347: When a mouse over a file is enough to cras... by Pick-A-Hill2019 on Sunday November 17, 2019 @07:58AM (#21557726)

wouldn't you load/call it during boot or when the mouse driver loads? If you have a mouse, you are almost certainly going to generate an on-mouse-over event at some point. The advantage is that it isn't running in ring 0.

[ Parent | on HN ]