Re:Zero-days in Cisco Discovery Protocol
by tptacek on Friday February 07, 2020 @12:26AM
(#22263465)
The words "to a degree" are doing a lot of work in that sentence, given where browser RCE vulnerabilities actually appear today in code.
Kernel bugs are obviously a part of modern bugchains, but they're used to escalate privileges, and usually not to gain native code execution in the first place. The enabling code execution arises from code that doesn't need to be in C/C++ at all.
Kernel bugs are obviously a part of modern bugchains, but they're used to escalate privileges, and usually not to gain native code execution in the first place. The enabling code execution arises from code that doesn't need to be in C/C++ at all.