Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes. It means that you can’t use a write primitive to simply modify an already executable page.


How does that help?


It means an attacker with an arbitrary-write vuln needs to be able to target a page as the JITted code is being written to it, rather than being able to target any existing page with code in it.


And since javascript is so focused on a single thread, it's easy to make sure it's not even running at the same time your JIT code is doing those writes.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: