That's a bit naive and not the point of this PoC. The exploit used a bug in the code generator. Normally, guard code would have been generated that would have caught that issue, but it just wasn't, and that's why the exploit worked.
So in theory, every program with that particular programming bug and the missing guard code (due to the code generator bug) is vulnerable.
Imagine a programmer has a shitty day, lacks concentration, and adds code like this to his internet-facing server app:
type Embedded struct {
offset [0x400100]byte
address uint32
}
type Struct struct {
*Embedded
bar int
}
var instance Struct
When handling an HTTP request that comes from the internet, instance.Embedded.address is filled from a GET parameter. Et voila, anyone who can do a GET request can overwrite memory, possibly leading to code execution.
The bug in the code was unintentional, because programmers (like all humans) make mistakes, the HTTP request was intentional (it was done by the attacker), and the exploit worked because of a bug in the code generation.
That's what I meant by vulnerable.
As a specific example, check out the two-part wrap-up of the Pwnium browser hacking competition[1] [2]. It's a great illustration of chaining weaknesses together to achieve a desired exploit.
[1] http://blog.chromium.org/2012/05/tale-of-two-pwnies-part-1.h...
[2] http://blog.chromium.org/2012/06/tale-of-two-pwnies-part-2.h...
That was my point. But without researchers investigating potential exploits, then developers have a harder time writing secure code.
This can only happen if the developer is malicious relatively to the compiler. Since you're the developer, and you're trying to avoid this exploit happening to you, there's no need to worry: Just don't perform the exploit.
It sounds to me like you're saying "we need to have more research so I can avoid exploiting the Go compiler".
Yes, you missed the part where I said this that was a generalised comment and that I'm aware this specific attack isn't a practical real-world vulnerability.
What you're doing is that typical thing that people do online when they're so busy trying to assert their intellectual superiority that you completely miss the point that was being raised.