News for hackers. Stuff that matters.

A comment on XZ backdoor: "It's RCE, not auth bypass, and gated/unreplayable.". Parent comment

Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by saagarjha on Sunday March 31, 2024 @03:25PM (#39887252)
Yes but that requires you to know that someone will use it beforehand.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by josephg on Sunday March 31, 2024 @07:13PM (#39889098)
Now that we know IFUNC can me misused like this, it would be pretty silly if we allow other, future exploits to use the same trick.
[ Parent | on HN ]
Re:XZ backdoor: "It's RCE, not auth bypass, and gated/unrepl... by saagarjha on Monday April 01, 2024 @08:28PM (#39901059)
ifunc was only used because it’s an obscure feature that is little-used and provides a way to convert a backdoor into easy execution. There are many others and it would be silly to try to catch them all.
[ Parent | on HN ]